Fix merchant update safety, webhook dedupe, and Soroban expiry API

[JhayJ22]

Summary

• Prevent mass-assignment in merchant updates by only copying allowlisted fields.
• Make webhook delivery job IDs deterministic and dedupable to avoid duplicate queue jobs for the same logical event.
• Restore the expiry-aware Soroban payment API expected by the payments service and the existing expiry tests.

Changes

• Safe merchant update path in src/merchants/merchants.service.ts
• Stable job ID generation in src/webhooks/webhook-delivery.service.ts and src/webhooks/webhook-delivery.processor.ts
• Reintroduce payment expiry helpers and error contract in src/blockchain-wallet/soroban.service.ts

Closes #172
Closes #175
Closes #178
Closes #179

[drips-wave]

@JhayJ22 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits