fix: singleton SecretManagerServiceClient + governor address guard + docs cleanup

Every call to getSecret() instantiated a new SecretManagerServiceClient,
opening a gRPC channel that was never closed. ~169 requests over 28 minutes
→ 488 MiB OOM. Fix: singleton client at module level.

Secret values are NOT cached (would break rotation on warm instances).

QuickNode evmAbiFilter ignores the 'contracts' field in templateArgs
(silently, empirically confirmed). Added MENTO_GOVERNOR_ADDRESS guard in
process-event.ts so events from other OZ Governor contracts on Celo don't
produce false notifications.

- Global TMP_FILES array + single EXIT trap (fixes trap overwrite on
  multiple deploy_webhook calls)
- Code comment explaining why templateArgs uses 'abiJson' not 'abi'
  (spec says 'abi', live evmAbiFilterGo endpoint requires 'abiJson')
- Comment explaining hardcoded webhook UUIDs and how to update them
- Updated Terraform filter_function blobs to current trimmed ABIs

- Delete bin/update-quicknode-filter.js (zombie script, never worked)
- Remove dead dev:webhook:* npm scripts
- Consolidate quicknode.tf comment: UPDATE=script, RECREATE=Terraform
- Rewrite README + ADDING_EVENTS.md to reflect actual deploy workflow

- 5 unit tests for get-secret.ts (singleton behavior, no caching, errors)
- 7 unit tests for process-event.ts governor address guard
  (canonical address, wrong address, all 4 event types, mixed-case, MedianUpdated)
- npm test now runs vitest before integration tests

Author: gisk0

src/utils/is-valid-quicknode-payload.ts

@@ -12,14 +12,15 @@ export default function isValidQuicknodePayload(
     "result" in requestBody &&
     Array.isArray((requestBody as QuicknodePayload).result) &&
     (requestBody as QuicknodePayload).result.every((event) => {
+      const e = event as unknown as Record<string, unknown>;
       return (
         typeof event === "object" &&
-        typeof (event as Record<string, unknown>).address === "string" &&
-        typeof (event as Record<string, unknown>).blockHash === "string" &&
-        typeof (event as Record<string, unknown>).blockNumber === "string" &&
-        typeof (event as Record<string, unknown>).logIndex === "string" &&
-        typeof (event as Record<string, unknown>).name === "string" &&
-        typeof (event as Record<string, unknown>).transactionHash === "string"
+        typeof e.address === "string" &&
+        typeof e.blockHash === "string" &&
+        typeof e.blockNumber === "string" &&
+        typeof e.logIndex === "string" &&
+        typeof e.name === "string" &&
+        typeof e.transactionHash === "string"
       );
     })
   );