Remove SideShift privateKey from env config

The SideShift affiliate account was compromised. SideShift confirmed the swap
integration works identically without the privateKey, so stop validating and
injecting it (it was sent as the x-sideshift-secret header). Account rotation
to a new affiliateId is handled operationally.

Author: j0ntz

CHANGELOG.md

@@ -3,6 +3,7 @@
 ## Unreleased (develop)
 
 - changed: Route maestro test builds to a dedicated Zealot channel so they no longer appear in the production release list.
+- removed: SideShift `privateKey` from env config; the swap integration no longer sends the affiliate secret header.
 
 ## 4.49.0 (staging)
 

src/envConfig.ts

@@ -385,9 +385,8 @@ export const asEnvConfig = asObject({
   SEPOLIA_INIT: asCorePluginInit(asEvmApiKeys),
   SIDESHIFT_INIT: asCorePluginInit(
     asObject({
-      affiliateId: asOptional(asString, ''),
-      privateKey: asOptional(asString)
-    }).withRest
+      affiliateId: asOptional(asString, '')
+    })
   ),
   SOLANA_INIT: asCorePluginInit(
     asObject({