test(api): cover referral bonus queue edges

[pengyuayn]

What

Adds focused unit coverage for referral bonus queue edge cases.

Why

Referral payouts are money-moving side effects, so the queueing service should document when it must create/enqueue a payout and when it must safely do nothing.

How

• Covers missing referrals and already-rewarded referrals.
• Verifies embedded wallet addresses are preferred over Stellar addresses.
• Verifies missing payout addresses skip payout creation.
• Covers the five USDC referrer cap and zero-rounded bonus skip.
• Covers no-challenge attribution path without fraud lookup.
• Verifies non-pending payout records are not marked rewarded or enqueued.

Test plan

• ./node_modules/.bin/vitest run apps/api/src/services/referrals.test.ts
• ./node_modules/.bin/prettier --check apps/api/src/services/referrals.test.ts
• git diff --cached --no-color | node scripts/gitleaks.mjs detect --pipe --redact --config .gitleaks.toml --verbose
• ./node_modules/.bin/tsc -p apps/api/tsconfig.json --noEmit currently blocked by existing unrelated apps/api/src/routes/leaderboard.ts(196,1): error TS1128

Closes #398