fix: bootstrap e2e tests, error-envelope coverage, API key expiry enf… - #858

…orcement

## Summary

Four gap fixes that were previously open:

### 1. Real AppModule bootstrap e2e test
- Add test/app-module-bootstrap.e2e-spec.ts
- Boots the full AppModule (no mocks) exactly as main.ts does
- Verifies DI wiring: WalletsService, KeyManagementService, ApiKeyService,
  ApiKeyGuard, MaintenanceGuard, RateLimitGuard, PrismaService all resolve
- Confirms public endpoints (GET /v1/health, GET /v1/ready) are reachable
- Confirms ApiKeyGuard is globally applied (401 without key)
- Confirms HttpExceptionFilter returns structured envelope on 404s
- Documents duplicate IdempotentUserModule/TracingModule imports in AppModule
  (NestJS deduplicates them; regression guard added)

### 2. Error-envelope production bootstrap test
- Add test/error-envelope-bootstrap.e2e-spec.ts
- error-handling.e2e-spec.ts manually registers HttpExceptionFilter after
  app init, masking the case where it is removed from main.ts bootstrap
- New test replicates the exact main.ts setup sequence and independently
  verifies: envelope shape, requestId echo/generation, ISO 8601 timestamp,
  security (no stack traces / file paths), and that the filter (not NestJS
  default handler) is actually doing the formatting (timestamp/path/method
  absent from NestJS default output)

### 3. README + .env.example: remove phantom env vars
- Remove JWT_SECRET (never implemented, no corresponding code)
- Replace API_KEY_EXPIRY_DAYS (wrong name, never implemented) with the
  correct and now-implemented API_KEY_DEFAULT_EXPIRY_DAYS
- Add API_KEY_DEFAULT_EXPIRY_DAYS= to .env.example with full doc comment

### 4. Implement API_KEY_DEFAULT_EXPIRY_DAYS
- src/config/env.validation.ts: add API_KEY_DEFAULT_EXPIRY_DAYS to
  ValidatedEnv interface and validateEnv() with optionalInt parsing,
  range [0, 3650], default 0 (non-expiring)
- src/api-keys/api-key.service.ts: read API_KEY_DEFAULT_EXPIRY_DAYS from
  ConfigService; in createApiKey(), compute expiresAt = now + N*days when
  the caller omits expiresAt and defaultExpiryDays > 0; explicit caller
  expiresAt always beats the default
- src/api-keys/api-key.service.spec.ts: five new unit tests covering:
  default expiry window, explicit override, zero=non-expiring, rejection
  after expiry, DB status flip to EXPIRED
- test/api-key-expiry.e2e-spec.ts: full e2e suite (offline, in-memory Prisma
  stub) covering: default expiry applied, explicit override, non-expiring
  (0), first rejection 401, status flip verified, second call still 401,
  future-dated key valid, boundary (1 ms past) rejected

## Affected files
- test/app-module-bootstrap.e2e-spec.ts        (new)
- test/error-envelope-bootstrap.e2e-spec.ts    (new)
- test/api-key-expiry.e2e-spec.ts              (new)
- src/api-keys/api-key.service.ts              (modified)
- src/api-keys/api-key.service.spec.ts         (modified)
- src/config/env.validation.ts                 (modified)
- README.md                                    (modified)
- .env.example                                 (modified)