fix: gate Swagger in production, stop deposit clobbering monthlyDeposit, raise stale idempotency window

[privexlabs]

Summary

• Swagger/OpenAPI docs are no longer mounted when `NODE_ENV=production`; the `api/docs` UI previously exposed the full API surface (routes, DTO shapes, validation constraints) to unauthenticated visitors.
• `MaintenancePoolService.deposit` no longer overwrites `monthlyDeposit` with the latest single deposit amount; the field now records the sponsor's standing recurring commitment and can be set at pool creation via an optional, validated DTO field.
• `IdempotencyInterceptor`'s stale-processing reclaim window is raised from 30s to 90s so it comfortably outlasts the Soroban client's worst-case duration (~20s polling ceiling plus RPC round-trips), preventing a retry from reclaiming a row whose original money-moving request was still actively running.

Changes

• `src/main.ts`: gate `SwaggerModule.createDocument`/`SwaggerModule.setup` behind `env !== 'production'`, consistent with the existing JWT-secret production guard; startup log only advertises `/api/docs` outside production.
• `src/maintenance-pool/maintenance-pool.service.ts`: removed `pool.monthlyDeposit = amount` from `deposit()`; `create()` now passes the optional `monthlyDeposit` through.
• `src/maintenance-pool/dto/create-pool.dto.ts`: added optional `monthlyDeposit` validated with the existing `@IsMoneyAmount()`.
• `src/common/idempotency/idempotency.interceptor.ts`: `STALE_PROCESSING_MS` 30s → 90s, exported with a doc comment deriving the value from `SorobanClientService.pollTransaction`'s worst case.
• Updated specs: idempotency interceptor spec imports the shared constant instead of duplicating it; maintenance pool spec asserts deposits leave `monthlyDeposit` untouched.

Issues

Resolves #99
Resolves #93
Resolves #90
Resolves #102

Verification

Manual code review only: full diff inspected against each issue's report, entity/DTO/config/spec conventions checked, no unrelated changes. `cargo build` and `cargo test` were not run (Node/NestJS project); test suite and build were not executed.

[vercel]

@harystyleseze is attempting to deploy a commit to the chonilius' projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@privexlabs Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits