routes: /meta sources version from package.json, adds build and network info

[Codeinx]

Problem

src/routes/v1/index.ts hardcoded the version string in the /meta response, duplicating package.json and guaranteed to drift on the first release. The description also still called the service a "scaffold".

What this does

New module src/meta/version.ts, used by the /meta handler:

• Version sourced from package.json, read at request time (cached after the first read) instead of a literal.
• build.commit / build.builtAt, sourced from BUILD_SHA / BUILD_TIME environment variables rather than shelling out to git — the deployed container has no .git directory. Both default to "unknown" when unset. .env.example documents them as CI-injected (e.g. BUILD_SHA=${{ github.sha }}).
• network.stellarNetwork, network.sorobanRpcUrl, and the three configured contract addresses, so integrators hitting /meta can confirm which environment they're pointed at.
• Rewritten description — no "scaffold" wording remains.

Testing

src/meta/version.test.ts covers: version sourced from package.json, the "unknown" default when build env vars are absent, build info being read correctly when present, network/contract reporting, and the absence of "scaffold" in the description.

npm run lint, npm run build, npm test, and npm audit --audit-level=high are all clean on this branch.

Scope note

This adds src/meta/** and touches src/routes/v1/index.ts (only the /meta handler body plus two new imports) and .env.example. Heads up for whoever merges: PR #58 (dispute routes) also touches src/routes/v1/index.ts, adding a route-registration line directly below the /meta handler this PR rewrites. The two changes don't conflict logically, but depending on merge order there will be a small one-hunk conflict in that file to resolve by hand — flagging it now rather than leaving it as a surprise.

Closes #10.