[infra] Add NETWORK_PASSPHRASE to render.yaml gateway service env

[yinkscss]

Context

AppConfig reads NETWORK_PASSPHRASE for Soroban transaction signing, defaulting to testnet. render.yaml sets SOROBAN_RPC_URL but omits NETWORK_PASSPHRASE.

Problem

A mainnet RPC URL with the default testnet passphrase would cause silent transaction failures in production.

Proposed scope

• Add NETWORK_PASSPHRASE to waveflow-gateway env in render.yaml
• Document mainnet vs testnet values in README production section
• Optionally validate passphrase prefix matches RPC host at gateway startup

Acceptance criteria

• render.yaml includes NETWORK_PASSPHRASE for gateway
• Production docs list correct passphrase for testnet and mainnet
• Misconfigured passphrase surfaces a clear startup error (optional but preferred)

References

• render.yaml
• crates/shared/src/config.rs
• .env.example

[BojayL]

/claim
Opened PR #47 with Render network passphrase config, docs, and startup validation.