feat: add rate limiting and suspicious activity detection (#103, #102)

[portableDD]

• RateLimitService: enforces per-merchant limits (10 tx/min, 100 tx/hour) with 429 on breach and a GET /api/v1/rate-limit/:merchantId status endpoint
• SuspiciousActivityService: detects burst transactions (≥5 in 10s), high failure rate (>70% of last 10 tx), and gas spikes (>4x rolling avg); emits structured Logger warnings on each alert
• TransactionsService.record() now runs rate-limit check before saving and suspicious-activity analysis after, returning { transaction, rateLimit, suspiciousActivity }
• Full unit test coverage for both new services and the updated record() method

closes #102 , closes #103

[drips-wave]

@portableDD Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits