feat: add compression middleware with brotli support (closes #218)

[aojomo]

Summary

Adds response compression middleware to reduce bandwidth usage and improve mobile latency for API responses — especially analytics, transaction history, and agent logs.

Closes #218

Changes

New file: src/middleware/compression.ts

Configured compression middleware with:

• Brotli (br) support — uses Node's native zlib.createBrotliCompress when the client advertises Accept-Encoding: br, falling back to gzip, then deflate
• 1 KB threshold — only responses larger than 1024 bytes are compressed
• /metrics exclusion — the Prometheus metrics endpoint is skipped (Prometheus scraper handles its own format)
• Custom filter function delegating to the default compressibility check for all other paths

Modified: src/index.ts

• Imported compression middleware and registered it globally via app.use() before route handlers but after security/parsing/rate-limit middleware — the correct position in the middleware stack

Modified: scripts/smoke-health.sh

• Added compression middleware verification step:
  1. Checks Vary: Accept-Encoding header (always set by middleware regardless of body size) — confirms middleware is active
  2. Checks Content-Encoding header on larger endpoints — confirms actual compression when body exceeds 1 KB threshold

Dependencies

• Added compression v1.8.1 (the standard Express compression middleware package with native brotli support via Node.js zlib)
• Added @types/compression v1.8.1

Acceptance Criteria

• Compression middleware applied globally before route handlers
• Brotli used when client advertises support (Accept-Encoding: br)
• /metrics excluded from compression
• Smoke test verifies Content-Encoding on compressible responses

Testing

• TypeScript typecheck: no new errors (pre-existing errors remain)
• Unit tests: unchanged behavior (pre-existing failures from missing env vars)
• Smoke test enhancements verified the middleware is active