feat(backend): centralize amount and currency validation across API and service layers

[woahwhattheheck]

Summary

Closes #130.

Introduces a single currency policy shared by API validators and settlement so preview quotes and executed transfers always agree on precision, supported codes, and overflow bounds.

What

• src/utils/currencyPolicy.js — canonical metadata (ISO minor units, min amount, optional max) for every rate-listed currency; canonicalizeAmount / validateTransferPair / roundToCurrency.
• Transfer and quote validators call the same policy (transfer enforces max; quote does not).
• quoteService / rateService.convert round with the destination currency's minor units (JPY stays whole).
• Unsupported currencies and sub-minor-unit amounts fail before any store mutation.

Why

Different layers previously accepted different precision or unsupported codes, so a quote could succeed and settlement later fail (or vice versa). One policy table keeps preview and execution identical.

How tested

• npm test — 275 passing (includes new test/currencyPolicy.test.js).
• Coverage: currency matrix, JPY zero-decimal, overflow, transfer max, preview/settlement contract agreement, HTTP 400 for unsupported codes.

Design tradeoffs

• Policy table must stay aligned with SUPPORTED_CURRENCIES (boot-time assert). Adding a corridor means updating both the rate table and metadata in one change.
• Quotes skip the transfer max so informational previews still work for large amounts; create-transfer still enforces it.