Fix CI: resolve unmerged conflicts across the backend + fix a hidden route collision

[prodbycorne]

Summary

main's CI has been failing on every run — several previously-merged PRs left their merge conflicts concatenated instead of resolved. This surfaced as a long chain of failures:

• package.json / package-lock.json: duplicate keys and a dropped closing brace → npm ci failed immediately (EJSONPARSE / EUSAGE).
• src/index.js: three conflicting "start/stop the server" implementations spliced together (duplicate server declarations, a hard syntax error). Reconciled into the one async startServer()/shutdown() design, folding indexerPoller back into it — it's still used by src/routes/indexer.js but had been dropped from the lifecycle code by the bad merge.
• src/routes/airdrops.js: misplaced require()s stuck mid-function, a duplicate router/upload/validator, a dead broken validateAirdropCreate() left over from a since-superseded manual validator, and two POST routes each registered twice with different middleware — merged into one registration per route using every needed middleware.
• src/services/priceOracle.js: SOURCES had 6 entries instead of 3 — two competing circuit-breaker designs for the same 3 sources merged side by side instead of combined. Fixed to 3 entries carrying both the generic CircuitBreaker (used for fetch-with-failover) and the per-source getCircuitState (used by /health's price_source_circuits).
• src/config.js: duplicate databaseUrl / stellar.* keys where a raw process.env fallback silently overrode the envalid-validated value (JS object literals: last key wins).
• Several test files (auth, alerts-routes, circuitBreaker, health, prices, airdrops): duplicate mock methods, orphan fragments, or two entire test files concatenated together — fixed by keeping whichever version matches current source behavior and removing the dead duplicate.

A real bug found once the suite could finally run

src/routes/indexer.js registered GET /airdrops/:id/recipients — the exact same path as the airdrops CRUD API's paginated recipients endpoint in src/routes/airdrops.js. Since indexerRouter is mounted before airdropsRouter in src/index.js, it silently shadowed the real endpoint: the paginated off-chain recipients list has never actually been reachable through the deployed app. Renamed the indexer's endpoint to GET /airdrops/:id/onchain-recipients (it serves indexed on-chain claim data, a different concern from the off-chain uploaded recipient list) and updated its test to match.

Test plan

• npm ci — succeeds (was failing with EJSONPARSE)
• npx @redocly/cli lint openapi.yaml — valid
• npm test — 337/337 passing across 37 suites (was 9 suites failing / 33 tests failing)

These are the exact steps .github/workflows/ci.yml's test job runs. (docker-build job not verifiable locally — no Docker available in this environment — but the Dockerfile and package.json/lockfile it depends on are unchanged in shape beyond this fix.)