fix: resolve issues #860, #861, #862

[BethelDev-io]

closes #860
closes #861
closes #862

Issue #860 — API key scope validation per endpoint

• Add ApiKeyScope enum (signals:read/write, trades:read/write, portfolio:read, analytics:read, admin:*)
• Create ApiKeyScopesGuard that reads @RequireScopes metadata and rejects with 403 on missing scopes
• Update @RequireScopes decorator to use ApiKeyScope enum (type-safe)
• Update CreateApiKeyDto, ApiKeyResponseDto, ApiKey entity to use ApiKeyScope enum
• Refactor ApiKeyAuthGuard to handle auth only; scope enforcement moved to ApiKeyScopesGuard
• Apply @RequireScopes to all trade and signal endpoints
• Export ApiKeyScopesGuard from ApiKeysModule
• Unit tests: correct scope granted, missing scope 403, admin wildcard, no key 401

Issue #861 — Mandatory idempotency key for trade execution and signal creation

• Add RequireIdempotencyKeyGuard that enforces Idempotency-Key header
• Missing header returns 400 Bad Request with clear instructions
• Concurrent duplicate returns 409 Conflict with Retry-After: 2 header
• Add @UseGuards(RequireIdempotencyKeyGuard) to POST /trades/execute
• Add @UseGuards(RequireIdempotencyKeyGuard) and IdempotencyInterceptor to POST /signals
• Unit tests: missing header 400, empty header 400, valid header pass, concurrent 409, post-finish reuse

Issue #862 — Comprehensive health check probes

• Add GET /health/live explicit liveness endpoint (process-alive, no dependency checks)
• Existing GET /health/ready readiness probe checks database, Redis, BullMQ, Soroban RPC
• Update k8s/base/deployment.yaml to use /health/live for startup and liveness probes
• Unit tests: /live returns 200 with empty indicator list, /ready returns 503 on each dependency failure (postgres, redis, soroban), latency field present in all results