fix(comparison): validate project existence and reject unknown ids with 404 (#930)

[mopxam-art]

Why

Endpoints /v1/comparison, /v1/comparison/ranking, /v1/comparison/export, and /v1/dashboard/timeseries/:id synthesized simulated metrics for arbitrary and nonexistent project IDs without validating existence against the on-chain registry. This allowed consumers to receive fabricated portfolio data and probe arbitrary IDs.

What

• Added existence validation via projectExists in src/lib/comparison.ts (loadProjectMetrics, compareProjects, generateRanking) and src/routes/dashboard.ts (/timeseries/:id).
• Unknown or unissued project IDs now fail fast with HTTP 404 not_found (Project <id> not found).
• Clamped upper ID bounds to MAX_U32_PROJECT_ID so valid contract u32 ranges are delegated to registry existence checks rather than throwing arbitrary 400 errors.
• Documented 404 not_found behavior in API.md for /v1/dashboard/timeseries/:id, /v1/comparison, /v1/comparison/ranking, and CSV exports.
• Added comprehensive unit tests covering range boundaries, positional ID permutations, ranking criteria, timeseries filters, and stress concurrency (src/__tests__/comparison-existence-validation.test.ts). All tests pass.

Verified

• All unit and integration tests pass (jest src/__tests__/comparison-existence-validation.test.ts, 125 tests pass).
• Full test suite passes (124/124 test suites pass).
• TypeScript typecheck (tsc --noEmit) passes with 0 errors.
• Production build (tsc) succeeds cleanly.

Closes #930

USDC (EVM / Arbitrum / ERC20): 0x387c064ccf729a4846b62e95dc6b70e4d4c41e73