feat(backend-sep38): [sep-38] update quotes cache expiration rules

[GideonBature]

Summary

• Centralizes SEP-38 quote cache expiration settings in sep38-quotes-cache.config.ts with validation that cache TTLs cannot outlive indicative quote expiration.
• Adds configurable SEP38_* environment variables for indicative quote expiration, firm quote validity, cache TTL, stale TTL, and assets cache TTL.
• Updates Sep38Controller to use the shared config and reject cached quotes whose expiration_time has passed, refetching fresh prices instead.
• Aligns stale-while-revalidate with quote expiration by reducing the default stale TTL from 120s to 30s (30s cache + 30s stale = 60s quote expiration).

Changes

Area	Change
sep38-quotes-cache.config.ts	New config module with validateSep38QuotesCacheConfig(), isQuoteExpired(), and buildQuoteExpirationTime()
env.ts	Five new SEP38_* env vars with per-field bounds and cross-field validation at startup
sep38.controller.ts	Replaces hardcoded TTLs; validates cached quotes before returning them
.env.example	Documents new SEP-38 cache settings

Test plan

• npx jest src/config/sep38-quotes-cache.config.test.ts — validation rules and expiration helpers
• npx jest src/api/controllers/sep38.controller.test.ts — quote calculation and expiration behavior
• npm run test:backend — full backend suite (note: unrelated pre-existing failures in multisig/sep31 tests)
• Verify indicative quote expiration_time matches SEP38_INDICATIVE_QUOTE_EXPIRATION_SECONDS
• Verify firm quote expiresAt matches SEP38_FIRM_QUOTE_VALIDITY_SECONDS
• Confirm invalid env combos (e.g. cache TTL + stale TTL > quote expiration) fail at startup

Closes #620

[drips-wave]

@GideonBature Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits