Validate config bounds for rate limits and currencies

[Elevate341]

What does this PR do?

This PR tightens config validation for several runtime safety boundaries:

• validates all per-route rate-limit maxima as positive safe integers before the router starts
• validates framework.watchers.transactionTimeoutMs as a positive safe integer
• validates assets.defaultCurrency as an uppercase ISO 4217 three-letter code
• keeps the existing defaults and rate-limit response behavior unchanged

This prevents fractional, zero, negative, or unsafe values from slipping through config validation and affecting throttling or timeout behavior.

How to test?

1. Run the project test suite:

   bun test

2. Verify the targeted config validation cases still pass for:
   • windowMs
   • authChallengeMax
   • authTokenMax
   • webhookMax
   • depositMax
   • transactionTimeoutMs
   • defaultCurrency
3. Confirm invalid values such as 0, negatives, fractions, NaN, Infinity, and malformed currency strings are rejected during config validation.
4. Confirm valid values continue to work without changing existing route rate-limit behavior.

Checklist

• My code follows the code style of this project.
• I have added tests for my changes.
• I have updated the documentation accordingly.
• I have run bun run test and bun run lint locally.

Issue Reference

Closes #484
Closes #483
Closes #482
Closes #485

[drips-wave]

@Elevate341 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits