feat: validate Stellar addresses (strkey) at startup

[Darkdruce]

Problem

STELLAR_GATEWAY_PUBLIC and asset issuer addresses were accepted as raw strings. A typo in the gateway key silently produced unpayable intents (the destination address never matches a real account), and invalid input was never rejected.

Change

• New src/strkey.rs — a small, dependency-free Stellar strkey validator. It checks the G account version byte, the 56-character length, the base32 (A-Z2-7) alphabet, and the CRC16-XModem checksum. Exposed as is_valid_account_id / validate_account_id for reuse.
• Fail fast at boot — Config::from_env now validates the gateway key (when configured) and every accepted-asset issuer, returning a clear error so an invalid address aborts startup instead of booting into a broken state:

  Error: STELLAR_GATEWAY_PUBLIC (GBBD47IF_TYPO...) is not a valid Stellar account address: must be 56 characters
  

  The unconfigured placeholder (UNCONFIGURED) is skipped, preserving the "poller idle until configured" behaviour.
• README — documents that the gateway key and asset issuers are strkey-validated at startup.

On the "API boundary" task

The current API exposes no user-supplied Stellar address field — destination_address is the gateway's own address (output), and merchant_id is an opaque label, not an address. So validation is applied where addresses actually enter the system (config ingestion), and the validator is exported (pub mod strkey) ready for any future address-bearing endpoint.

Tests

src/strkey.rs: accepts a real account address (which also proves the base32 + CRC16 implementation), and rejects corrupted checksum, wrong version byte, bad length, non-base32 characters, and a secret-seed (S...) prefix.
src/config.rs: validate_addresses accepts a real gateway key + default issuer, and rejects a corrupted gateway key and an invalid issuer.

Acceptance criteria

• Invalid gateway key fails fast at boot with a clear error.
• Unit tests cover valid and corrupted strkeys.

Closes #6