Fix fx-engine cache growth, DLQ header loss, asset audit gaps, and IndexedEvent null dedup

[praizehimm]

Summary

Fixes four issues, each verified against actual current code/behavior (not just the issue text) before implementing:

#615 — FX engine rate refresh writes to Redis without a TTL so stale rates persist after upstream outage
resolveRate()'s computed pair-rate cache (computedRateCache) is an in-memory Map, not Redis — there's no Redis-backed rate cache in fx-engine to add an EXPIRE to. The read path already refuses to serve an expired entry (now - computedAt >= ttlMs triggers a live recompute). What was actually missing: nothing ever removed an expired entry, so during a prolonged upstream outage (refresh keeps failing, updateBaseRates()'s computedRateCache.clear() never runs) the map grows unbounded — every pair ever queried sits in memory forever. Added pruneExpiredComputedRates(), run once per refresh tick, to reclaim entries past RATE_TTL_MS regardless of whether that tick's fetch succeeded.

#614 — Settlement webhook retry does not preserve custom headers from original webhookHeaders
The file/route the issue pointed at (services/settlement-engine's settlement-retry route) already copies webhookHeaders onto the retried Settlement row and rebuilds the delivery from it (fixed previously under #569) — that path was already correct. The real gap was in a different service: services/indexer's POST /api/admin/webhooks/dead-letter/:id/replay re-enqueued a dead-lettered delivery with only url, event, and signingSecret, dropping job.data.headers — the merchant's Authorization / X-Idempotency-Key headers that travel with every delivery from dispatchPendingWebhookDeliveries onward. A delivery that exhausts retries, lands in the DLQ, and gets manually replayed would arrive at the merchant without its auth header and get rejected — the exact failure mode #614 described, just in the indexer's DLQ path rather than settlement-engine.

#613 — SupportedAsset isActive toggle has no audit log entry
PATCH/DELETE /api/admin/assets/:code already wrote an AuditLog row on every change (asset.updated / asset.deleted, gated behind serviceAuth) — audit logging wasn't missing. The actual gap: both routes always logged { before: null, after: ... }, so forensics could see the new state but never what changed (e.g. whether isActive actually flipped true → false). PATCH now does a findUnique before the update and logs it as before; DELETE now logs Prisma's own delete() return value (the deleted row) instead of null, at no extra query cost.

While verifying this one, found and fixed an unrelated build-breaking bug: normalizeAndValidateEmail (added in 269addb, #468) was declared with a top-level export while physically nested inside buildApp()'s body — invalid syntax (TS1184: Modifiers cannot appear here) that left the whole service unable to build or even parse under ts-node/esm. google-oauth-domain.test.ts already imports it as a named export from ./index.js, so the fix hoists the function to true module top level rather than just dropping export.

#612 — Prisma IndexedEvent unique constraint on (stellarId, contractId, ledger) allows null stellarId duplicates
Confirmed as described: Postgres treats NULL <> NULL, so the plain @@unique([stellarId, contractId, ledger]) never rejected two stellarId-less rows sharing a (contractId, ledger). New migration deduplicates existing offenders (keeps the earliest row per group) and recreates the index with NULLS NOT DISTINCT (Postgres 15+; this repo runs postgres:16-alpine). Prisma's schema DSL can't express NULLS NOT DISTINCT, so schema.prisma keeps the @@unique as-is with a comment pointing at the migration — the same pattern this repo already uses for other DB-only changes (encrypt_signing_secrets, the *_comment migrations). No application code changes needed: persistEvent()'s existing P2002 catch-and-skip now covers this case for free.

Test plan

• fx-computed-cache-ttl.test.ts (new) — expired entries evicted, fresh entries kept, boundary case, unbounded-growth scenario reclaimed
• dlq-replay-headers.test.ts (new) — DLQ replay forwards headers alongside url/event/signingSecret
• supported-asset-audit.test.ts (new) — PATCH/DELETE log real before/after diffs, visible via GET /api/admin/audit-log?entityType=SupportedAsset
• Migration verified against a local postgres:16-compatible instance: pre-existing duplicate null-stellarId rows deduplicated without touching unrelated rows; fresh duplicate insert rejected by the new index; prisma migrate diff --to-migrations prisma/migrations --exit-code reports no difference both immediately after applying and after simulating the CI rollback-and-reapply job (same checks .github/workflows/ci.yml runs)
• tsc --noEmit confirms the TS1184 build-breaker is gone in api-gateway

Closes #612
Closes #613
Closes #614
Closes #615

[drips-wave]

@praizehimm Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits