test(currency): cover whitelist normalization invariants

[h1065153539-create]

Closes #458

Summary

• add src/services/currency/whitelist.test.ts with deterministic Vitest coverage for add/remove, idempotent add, empty vs populated lookups, admin guard behavior, and malformed code rejection
• add fast-check property tests for normalization idempotence and order-insensitive set replacement
• centralize currency normalization in normalize_currency_code
• validate canonical ISO 4217-style codes as exactly three ASCII uppercase letters after trim/case normalization
• keep set_currencies atomic by validating all inputs before replacing the current whitelist

Verification

• npm test -- whitelist
• npm exec -- vitest run src/services/currency/whitelist.test.ts --coverage --coverage.include=src/services/currency/whitelist.ts (100% statements/branches/functions/lines for whitelist.ts)

Also attempted:

• npm run lint currently fails before linting because eslint.config.js imports missing src/observability/eslint-plugin-logger-schema.js
• npm run build currently fails on existing unrelated project-wide TypeScript errors outside the currency whitelist service

Security

The whitelist now rejects malformed, non-ASCII, overlong, and look-alike currency codes instead of silently adding them to the allow-list security boundary.