feat: health check breakdown, per-user SSE cap, claimable invalidation test, api-types sync doc

[david87131]

• [Backend] backend/src/routes/health.routes.ts liveness check does not distinguish 'DB unreachable' from 'indexer lagging' in its response body #1114 — /health now returns a checks object breaking down status per subsystem: database, indexer (enabled + lag), redis (only checked subsystems that actually exist in the codebase — no soroban RPC state client beyond a lightweight getHealth() ping, which is now also included as sorobanRpc). The top-level status field is unchanged for simple uptime monitors. Updated docs/api/flowfi.postman_collection.json's example response to match the new shape. Did not touch the 60s lag threshold (tracked separately) or build a status-page integration.
• [Backend] backend/src/controllers/sse.controller.ts does not cap the total number of concurrent SSE subscriptions per authenticated user across multiple streams #1115 — Added a per-authenticated-user concurrent SSE subscription cap (MAX_CONNECTIONS_PER_USER = 10), independent of and in addition to the existing per-IP cap. Tracked with the same counting-map pattern as the per-IP limit (userConnectionCounts), keyed by the authenticated user's public key, incremented/decremented alongside connection open/close. Returns 429 with a clear message when exceeded. Added tests covering: cap enforcement across different IPs, no cap for unauthenticated checks, and slot release on disconnect. Left the existing per-IP limit (MAX_CONNECTIONS_PER_IP) untouched.
• [Backend] backend/src/services/claimable.service.ts has no test asserting cache invalidation happens when a withdrawal event is indexed #1116 — Added a test asserting cache invalidation behavior on claimable.service.ts: primes the cache, simulates an indexed TokensWithdrawn event (i.e. withdrawnAmount/lastUpdateTime advancing on the stream, exactly as handleTokensWithdrawn does), and asserts the very next read reflects the new claimable amount immediately — well within the cache TTL, not after it expires. No production code changes were needed: the cache key already folds in withdrawnAmount/lastUpdateTime via getStateFingerprint(), so a state change naturally produces a different cache key once callers pass the freshly-reloaded stream (which stream.controller.ts/withdraw.ts already do). Added a comment in the test explaining this. Did not touch the cache-key/token-collision bug or the TTL-default inconsistency (both tracked separately).
• [Frontend] frontend/src/lib/api-types.ts type definitions are hand-written and not generated from or validated against the backend's actual OpenAPI/swagger schema #1117 — Evaluated wiring openapi-typescript against the backend's existing /api-docs.json (built from backend/src/config/swagger.ts via swagger-jsdoc) — confirmed it's a small, safe addition. Added an opt-in npm run codegen:api-types script in frontend/ that a developer can run manually against a locally running backend; it writes to src/lib/api-types.generated.ts (gitignored) and does not replace api-types.ts or any call sites, and is not wired into CI. Also added a doc comment block at the top of frontend/src/lib/api-types.ts noting it must be manually kept in sync with backend/src/config/swagger.ts and pointing to the codegen script for cross-checking.

Test plan

• backend: npx vitest run tests/claimable.service.test.ts tests/sse.service.test.ts tests/sse.controller.test.ts — all pass
• backend: npx vitest run (full suite, after npx prisma generate) — same 4 integration test files fail as on main (require a live local Postgres DB; unrelated to this change) and 2 pre-existing rate-limiter failures unrelated to this change; all other 41 test files pass
• backend: npx tsc --noEmit — same 15 pre-existing errors as on main in untouched files; no new errors in changed files
• frontend: npx tsc --noEmit — same pre-existing parse errors in unrelated files as on main; no errors in api-types.ts
• frontend: npx vitest run — 182/182 tests pass; same 2 pre-existing broken test files as on main (unrelated .ts files containing JSX)

Fixes #1117
Fixes #1116
Fixes #1115
Fixes #1114