Cap transaction history count and update Google auth dependency

[afurm]

Summary

• Cap GET /api/transactions/last?count= at 100 results.
• Add route-level and e2e regression coverage for oversized count values.
• Document the new count maximum in docs/API.md.
• Update google-auth-library to 10.6.2 and refresh package-lock.json.

Why

/transactions/last accepted any positive integer for count, so an authorized caller could request an unbounded number of transaction rows. Capping the value keeps the endpoint predictable and limits unnecessary database and response work.

The dependency update removes the production gaxios -> uuid advisory reported by npm audit --omit=dev.

Validation

• npm test
• npm audit --omit=dev

Note: npm run test:e2e could not run locally because Testcontainers could not find a working container runtime in this environment.