fix(scorechain): drop code default for risk threshold — fail loud instead of defaulting

[TaprootFreak]

Removes the code fallback for the Scorechain risk threshold. The value now comes solely from the SCORECHAIN_RISK_THRESHOLD env var — no code default — so a missing value fails loud instead of silently defaulting.

Changes

• config (config.ts): SCORECHAIN_RISK_THRESHOLD unset → undefined (was ?? 70). riskThreshold: number | undefined.
• isHighRisk (scorechain-screening.service.ts): throws if the threshold is null/NaN. A missing value must not silently disable the gate (riskScore < undefined/NaN is always false). The throw is caught by the screenScorechain callers (buy-crypto / buy-fiat preparation) and routes the tx to manual review — fail-closed + loud.
• test (scorechain-screening.service.spec.ts): sets SCORECHAIN_RISK_THRESHOLD=70 in beforeAll (restored in afterAll) so the score-vs-threshold assertions stay deterministic. Only this spec calls the real isHighRisk; the buy-crypto/buy-fiat preparation specs mock it.
• docs: drop the now-stale "(default 70)" from the spec.

Scope / safety

• The value is provided as an env var by the deployment environment; prod + dev already set it, so no throw in real environments.
• No entity/schema change. riskThreshold is read only by isHighRisk, so no other consumer sees the widened type.
• Locally isHighRisk is unreachable without SCORECHAIN_API_KEY (the screenScorechain gate returns early), so a local run without the threshold does not throw.

[TaprootFreak]

Completed in 2 review passes, each running an independent conformity review and a logic/security review in parallel — 0 issues on both passes:

• Logic/correctness (compliance-critical): verified end-to-end that removing the ?? 70 default cannot silently disable the gate — isHighRisk throws on null/NaN, and the throw is caught by both screenScorechain callers (buy-crypto / buy-fiat preparation) → SCORECHAIN_HIGH_RISK → PENDING manual review (fail-closed + loud). riskThreshold is read by no other consumer, so the number | undefined widening breaks nothing.
• Tests: the screening spec sets the threshold explicitly (70, restored in afterAll) so the score-vs-threshold assertions stay deterministic; only this spec calls the real isHighRisk (the prep specs mock it).

The value is provided as an env var by the deployment environment; prod + dev already set it, so no throw in real environments. All CI checks green.

(Branch history was rewritten to keep infrastructure/deployment details out of this public repo; content is otherwise unchanged.)