Feat/fx cost aware selection new

[edochieblessing09-max]

Closes #551

PR Description:

## Summary

Adds budget-aware FX rate provider selection that respects per-tenant monthly spend caps and gracefully degrades to cheaper providers when the cap is close.

## Changes

### New Files
- `src/services/fxProviderBudgetRegistry.ts` — Per-tenant monthly spend tracking with pluggable `SpendStore` interface and `InMemorySpendStore` for dev/test.
- `src/services/fxCostAwareSelector.ts` — `CostAwareRateSelector` that ranks providers by accuracy, enforces budget caps, degrades gracefully, records spend, and emits Prometheus metrics.
- `src/services/fxCostAwareSelection.test.ts` — Comprehensive test suite covering budget exhaustion, fallback edge cases, and multi-tenant isolation.
- `docs/fx-cost-aware-selection.md` — Full documentation with architecture diagram, config guide, security assumptions, and failure-path table.

## Design Decisions

### Never block distributions
`CostAwareRateSelector` enforces at construction time that at least one zero-cost provider exists. When all paid providers are exhausted, the free-tier provider (e.g., ECB) is always used.

### Fail-open on storage errors
`FxProviderBudgetRegistry.isProviderAvailable` and `isProviderNearLimit` catch storage exceptions and return safe defaults (`true` / `false` respectively) so a DB outage cannot freeze rate lookups.

### Cost values are operator-defined
`costUsdPerCall` is set in code, not derived from external inputs, preventing cost-manipulation attacks.

### Metric labels carry no PII
Only `provider_id` (not `tenant_id`) is used as a label dimension to protect user privacy.

## Emitted Metrics

| Metric | Type | Description |
|---|---|---|
| `fx.provider.spend_month` | Gauge | USD spend for a provider in the current calendar month |
| `fx.provider.degraded_total` | Counter | Selections where a cheaper provider was used due to budget pressure |
| `fx.provider.selection_total` | Counter | Total provider selection attempts |

## Security Assumptions

- `tenantId` is pre-authenticated by the caller — registry performs no auth.
- Negative spend increments throw `RangeError` immediately.
- Budget caps are hard limits, not soft advice.
- Storage failure → fail-open (providers treated as available).
- Missing free provider at startup → `Error` thrown in constructor.

[drips-wave]

@edochieblessing09-max Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits