Fix: Harden API error handling, SQS retries, IAM permissions, and adaptor integrity

[mozluk]

Description

This PR addresses critical backend, infrastructure, and financial-data integrity defects identified in the yield-server repository during the workspace-wide audit[cite: 34].

Key Changes

• Async Error Handling & Observability (src/utils/asyncHandler.js, src/api/app.js, src/queries/*.js):
  • Added a shared asyncHandler wrapper to ensure Express 4 routes properly forward rejected async promises to the centralized error middleware[cite: 34].
  • Replaced silent return new AppError paths with explicit throw statements across controllers, query helpers, and triggers[cite: 34]. Invalid configuration UUID requests now return explicit HTTP 400 responses[cite: 34].
  • Replaced the unsafe res.render() error handler (which lacked a view engine) with safe JSON responses that do not leak internal details[cite: 34]. Redis cache reads/writes now handle failures gracefully, log context, and treat Redis as optional when REDIS_URL is absent[cite: 34].
• SQS & Scheduled Task Reliability (src/handlers/triggerEntrypoint.js, src/handlers/triggerAdaptor.js, serverless.yml):
  • Scheduled invocations no longer swallow queue-production failures; they now rethrow explicitly[cite: 34].
  • SQS handlers now properly return batchItemFailures and enable ReportBatchItemFailures, ensuring failed records are isolated and retried without replaying successful ones[cite: 34].
• Infrastructure Hardening & IAM (serverless.yml):
  • Removed overly broad wildcard permissions (Resource: '*') for S3 (s3:*Object*, bucket listing) and SQS (sqs:SendMessage)[cite: 34]. The Lambda role is now strictly scoped to the generated CloudFormation bucket, the shared data bucket, and the generated adapter queue ARN[cite: 34].
• Secrets Management (src/adaptors/mars-lend/index.js, env.js, serverless.yml):
  • Removed the hardcoded x-apikey credential from the Mars request URL[cite: 34]. The adaptor now securely reads MARS_API_KEY from the environment, URL-encodes it, and safely omits the query parameter when unconfigured[cite: 34].
• Financial-Data Integrity & Fallbacks (src/adaptors/enclabs/index.js, src/adaptors/merkl/index.js, etc.):
  • Fixed critical fallback corruption in the enclabs adaptor where failing RPC calls previously substituted a cToken address or forced 18 decimals, producing materially misleading TVL and borrow metrics[cite: 34]. Required underlying-token and decimal calls now skip the affected market with structured warnings, and optional LTV data is omitted rather than forced to zero[cite: 34].
  • Removed silent empty catch blocks in merkl, berapaw, ichi, mezo, mystic-finance, and upshift adaptors, replacing them with contextual diagnostic logs[cite: 34].