fix: preflight max-age config, durable webhook metrics, degraded boot, ledger cursor CAS (#341-#344)

[Sweet-Kid]

What changed

• ** closes [enhancement] No CORS preflight caching headers #344 — CORS preflight caching:** Access-Control-Max-Age on OPTIONS responses
  is now sourced from CORS_MAX_AGE_SECONDS (default 86400) instead of a hardcoded
  literal, so operators can tune the preflight cache window without a code change.
• ** closes [bug] webhookDispatcher metrics reset on process restart - no persistence #343 — webhook delivery metrics:** counters moved from process memory to Redis —
  one aggregate hash plus one hash per webhook, written through with HINCRBY on every
  completed delivery (fire-and-forget, never able to fail the delivery). hydrateMetrics()
  reloads them at startup, so success/failure rates survive restarts.
• ** closes [enhancement] No graceful degradation when Redis is down during startup #342 — startup without Redis:** startServer() now runs degraded when Redis is
  unreachable: one explicit warn, metrics hydration treated as best-effort, then cache
  warm. Neither step can stop the process from listening; both recover once ioredis
  reconnects.
• ** closes [bug] eventPoller pollOnce uses previousLedger from store but doesn't handle null race #341 — indexer:last_ledger race:** cursor advance is now a compare-and-set Lua
  script (advanceLastLedger) that also refuses to move the cursor backwards. The poller
  saves events first (idempotent), then attempts the CAS; on losing the race it keeps its
  saved batch, warns, and reports { skipped: true, reason: 'concurrent cursor advance' }
  instead of silently rewinding another instance's progress.

Also repaired (broken on main, blocking the fixes above)

• src/config.js — const config = module.exports; + dangling object properties was a
  syntax error; restructured to const config = module.exports = { … }.
• /health — duplicate websocket key and undefined wsHealth.
• priceWebSocket.getHealth() — export lost in a merge, restored.
• priceOracle.fetchFreshPrice() — wrapperPromise/actualPromise were never declared
  ([bug] priceOracle inFlight map stores promise reference - concurrent callers get same rejection #417), which made single-flight pricing throw and silently failed cache warming.
• Missing Cache warm complete log asserted by cacheWarm.test.js.
• Stale test mocks: priceWebSocket, airdropExpiry job health, saveEvents,
  apiKeyRateLimit.tiers, price-refresh scan pattern.

[drips-wave]

@Sweet-Kid Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits