Remove SideShift privateKey from env config

The SideShift affiliate account was compromised. SideShift confirmed the swap
integration works identically without the privateKey, so stop validating and
injecting it (it was sent as the x-sideshift-secret header). Account rotation
to a new affiliateId is handled operationally.

Author: j0ntz

CHANGELOG.md

@@ -2,6 +2,8 @@
 
 ## Unreleased (develop)
 
+- removed: SideShift `privateKey` from env config; the swap integration no longer sends the affiliate secret header.
+
 ## 4.49.0 (staging)
 
 - added: Monero wallet import support

src/envConfig.ts

@@ -385,9 +385,8 @@ export const asEnvConfig = asObject({
   SEPOLIA_INIT: asCorePluginInit(asEvmApiKeys),
   SIDESHIFT_INIT: asCorePluginInit(
     asObject({
-      affiliateId: asOptional(asString, ''),
-      privateKey: asOptional(asString)
-    }).withRest
+      affiliateId: asOptional(asString, '')
+    })
   ),
   SOLANA_INIT: asCorePluginInit(
     asObject({