feat: add gzip compression middleware for API responses (#70)

[cyber-excel10]

Closes #70

Changes

• Added compression middleware to api/src/app.ts, registered early
  in the middleware chain (right after helmet)
• Set threshold: 1024 so responses under 1KB aren't compressed
  (overhead would outweigh the benefit)
• Added compression and @types/compression to dependencies
• Added tests in src/__tests__/compression.test.ts verifying:
  • Large JSON responses return content-encoding: gzip when the
    client sends Accept-Encoding: gzip
  • No compression header is set when the client doesn't accept gzip
  • Small responses (health check) stay uncompressed

Testing

All 3 new tests pass (NODE_ENV=development npx jest src/__tests__/compression.test.ts). Also manually verified with curl
against /api/v1/openapi.json.

Notes

While testing, i found two pre-existing issues unrelated to this change
(confirmed present on main via git stash before this PR):

1. Jest's default NODE_ENV=test fails the app's config validator,
   breaking most test suites unless NODE_ENV is set explicitly.
2. tsc --noEmit reports ~195 pre-existing type errors across the
   codebase (unrelated files) — confirmed this PR introduces none.

Happy to file separate issues for these if useful.

[vercel]

@cyber-excel10 is attempting to deploy a commit to the smartdevs17's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@cyber-excel10 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[cyber-excel10]

Notes on failing CI checks

I investigated every failing check on this PR and confirmed (via
git stash + rerunning against main/this branch's committed state)
that all of them are pre-existing and unrelated to this change:

1. npm run lint fails repo-wide with
   EslintPluginImportResolveError: typescript with invalid interface loaded as resolver — an eslint-plugin-import/TypeScript resolver
   tooling incompatibility. Fails identically in both api (on
   auth.test.ts, not touched by this PR) and oracle (on
   oracle/src/config.ts, an unrelated workspace).

2. Contracts — Fuzz (Smoke) fails due to pre-existing Rust
   compile errors in unrelated contract code (token_adapter.rs,
   events.rs, storage.rs) — unrelated Soroban smart-contract code,
   not part of this Node.js/API change.

3. Contracts — Lint, Build, Test is explicitly labeled by the
   repo's own CI script as "non-blocking — pre-existing issues".

4. tsc --noEmit reports ~195 pre-existing type errors across 37
   unrelated files (also confirmed present on main); this PR
   introduces zero new TypeScript errors in app.ts.

Happy to file separate issues for any of these if useful... I wanted to
flag them here rather than leave failing checks unexplained.