Validate webhook keyType against the ENUM; document rate-limit/IP trust decisions

Found in code review of PR #2 (develop→main).

LOW — AdminWebhookService.create. keyType was persisted as a raw @NotBlank string. webhook_subscription.key_type is ENUM('PERSONAL','BUSINESS','GOVERNMENT'), so any other value (e.g. SYSTEM) surfaced as a driver data-truncation 500 instead of a clean 400. Added validateKeyType against the three valid values (deliberately NOT SYSTEM) → 400 INVALID_BODY. keyType is delivery metadata only (dispatcher matches on account_id/firm_id), so no routing impact. Added an IT asserting rejection + no row persisted.

Documentation-only (accepted risks, verified safe by adversarial review):

• RateLimitInterceptor.clientIp fallback to getRemoteAddr() — keys only anonymous public-read buckets, no money/auth path; safe while the pod is unreachable off the Envoy gateway.
• AdminTransferController deliberately has no @RateLimit — a fail-closed limit would lock admins out during a Redis outage; leaked-SERVICE-key risk is better handled by key rotation.

Adversarially reviewed before/after; treasury-rest-api compiles (main + test).