Refactor/typescript enable stricter typescript compiler flags

[yunus-dev-codecrafter]

closes #359

Summary

Enable three stricter TypeScript compiler flags — noUncheckedIndexedAccess, exactOptionalPropertyTypes, and noImplicitOverride — and fix the resulting type errors with real narrowing (control-flow guards, nullish coalescing) rather than non-null assertions.

The flags were already set in tsconfig.json but the codebase had 4 latent type errors from prior work that predated the flag activation. This PR resolves those errors and expands test coverage to prevent regressions.

Related Issue

Closes #359

Validation

• npm run build
• npm run lint
• npm test

Changes

src/index.ts — 4 type-error fixes

Location	Error	Fix
aggregatePairStats (line ~2189)	k.split("::") destructuring yields (string | undefined)[] under noUncheckedIndexedAccess	Replaced destructuring with explicit parts[0] / parts[1] variables guarded by source !== undefined && destination !== undefined
/api/v1/pairs/bulk (line ~2367)	config.bulkMaxItems is number | undefined under indexed access on Record<string, number>	Added ?? DEFAULT_BULK_MAX_ITEMS fallback
/api/v1/quote/bulk (line ~2453)	Same as above	Same fix + reuse of DEFAULT_BULK_MAX_ITEMS constant

Introduced DEFAULT_BULK_MAX_ITEMS = 100 as a named constant alongside the existing BULK_ABSOLUTE_MAX.

src/__tests__/stores.test.ts — expanded coverage (12 → 69 tests)

Added test suites that exercise the exact scenarios the stricter flags protect against:

• Indexed access safety (noUncheckedIndexedAccess): config[key], Map.get(), Array.at(), pairRegistry iteration with split + guard
• Optional property correctness (exactOptionalPropertyTypes): ApiKeyRecord with/without scopes, rotatedAt, graceExpiresAt, expiresAt, lastUsedAt
• API key utilities: apiKeyPrefix, generateApiKeySalt, hashApiKeySecret, verifyApiKeySecret
• Accessor functions: isPaused, isReadOnly, setPaused, setReadOnly
• State management: isHydrating, setHydrating
• Serialization: getSnapshot, hydrateFromSnapshot (including legacy key rejection, malformed input tolerance)
• Constants: KNOWN_EVENT_TYPES, EVENT_LOG_CAP, EVENT_LOG_CAP_MAX, RATE_BUCKETS_MAX_IPS, HEALTH_PROBE_KEY

Checklist

• I kept the change focused on the linked issue.
• I added or updated tests for behavior changes.
• I updated documentation when commands, API behavior, or setup changed.
• I did not commit secrets, tokens, .env files, or private credentials.

Security Notes

No new security assumptions introduced. The ?? fallback for bulkMaxItems is defensive — it prevents a crash if config.bulkMaxItems were ever absent (which cannot happen under normal operation because defaultConfig() always sets it). The split guard in aggregatePairStats silently skips malformed pair keys instead of crashing, which is consistent with the existing defensive patterns in the codebase.

[mikewheeleer]

nice work — merging now