Remove unused STELLAR_GATEWAY_SECRET

[Haroldwonder]

Summary

• gateway_secret (from STELLAR_GATEWAY_SECRET) was read, validated, and redacted in Debug, but had no consumer anywhere outside config.rs — the gateway never signs or submits Stellar transactions.
• Overpayment refunds are documented as a merchant-side action triggered by the payment.overpaid webhook event, not something the gateway performs itself, so there's no outbound/signing feature that actually needs the secret.
• Per the issue's suggested fix, removed the variable (and its validation/docs) rather than build an unused signing/refund path, so operators are no longer asked to mount a live wallet secret key into a process that can't use it.

Changes

• Removed gateway_secret field, its from_env() wiring, validate_gateway_secret(), its Debug redaction, and its dedicated unit tests from src/config.rs.
• Removed the now-unused gateway_secret: String::new() entries from test Config fixtures (src/expiry.rs, tests/*.rs).
• Removed STELLAR_GATEWAY_SECRET from .env.example and the env var table in README.md, and added a short note clarifying the gateway never holds a secret key / never signs transactions, and that refunds remain a merchant-side action.

gateway_public (STELLAR_GATEWAY_PUBLIC) is untouched — it's actively used as the destination address the Horizon poller/stream watches.

Test plan

• cargo check --lib — compiles cleanly
• cargo test --lib — 89 passed, 0 failed
• grep -rn "gateway_secret\|GATEWAY_SECRET" src/ tests/ README.md .env.example — no results

Note: this repo's main currently has a pre-existing, unrelated compile break in src/main.rs (a join_task! macro moves each JoinHandle before a later use, plus a missing task_health field in one test fixture) that predates this change and is unrelated to issue #75 — confirmed via git stash against origin/main before making any edits. I left it out of this PR to keep it scoped to the gateway secret removal; happy to open a separate PR for it if useful.

Closes #75