test: add end-to-end integration tests for /api/billing (#949)

[Fayedamz]

Implements Supertest integration tests that hit the full /api/billing router end-to-end, covering:

• POST /api/billing/deduct: happy path, DB persistence, response shape
• Row-level idempotency via requestId (alreadyProcessed flag)
• Idempotency-Key header replay (Idempotent-Replayed header verified)
• Idempotency-Key conflict with different body → 409 IDEMPOTENCY_CONFLICT
• Input validation: missing requestId, empty apiId, all invalid amountUsdc formats (zero, negative, non-numeric, too many decimals, empty string)
• Auth enforcement: absent header, wrong-secret JWT, expired JWT → 401
• Malformed JSON body → 400
• x-correlation-id propagation verified via response tracing header
• GET /api/billing/deduct/request/:id: found, 404, unauthenticated
• POST /api/billing/disputes: open dispute, unauthenticated → 401
• GET /api/billing/disputes: list, unauthenticated → 401
• Concurrent identical requestId race → exactly one DB row

Infrastructure:

• pg-mem in-process DB (no Docker required)
• Soroban RPC fully mocked (no real network calls)
• JWT signed with JWT_SECRET from jest.env-setup.cjs
• Each test provisions its own isolated DB and tears it down in finally{}

Closes #949

[drips-wave]

@Fayedamz Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[greatest0fallt1me]

LGTM — clean, tested. Merged 🙌