test: add unit tests for get-secret singleton + fix deploy script comment

- Add vitest + 5 unit tests for src/utils/get-secret.ts:
  * Returns secret value from Secret Manager
  * Calls Secret Manager on every invocation (no value caching — ensures
    secret rotation takes effect immediately)
  * Reuses singleton SecretManagerServiceClient across calls (proves no
    gRPC channel leak)
  * Throws on empty secret payload
  * Throws on Secret Manager error

- Add code comment in deploy-quicknode-filter.sh explaining why templateArgs
  uses 'abiJson' instead of 'abi' (OpenAPI spec says 'abi', but the live
  evmAbiFilterGo endpoint requires 'abiJson' — empirically confirmed via
  500 errors). Prevents future reviewers from flagging this as a bug.

Author: gisk0

bin/deploy-quicknode-filter.sh

@@ -137,8 +137,14 @@ with open(os.environ["QN_PAYLOAD_FILE"], "w") as f:
 
 	info "Contracts: $(python3 -c "import json; d=json.load(open('${payload_file}')); print(', '.join(d['templateArgs']['contracts']))")"
 
-	# Update via template endpoint — internal name is evmAbiFilterGo (evmAbiFilter is display name)
-	# No pause/unpause needed for template updates.
+	# Update via template endpoint.
+	# NOTE on field names vs the OpenAPI spec:
+	#   The public OpenAPI spec (evmAbiFilter schema) lists the field as "abi".
+	#   The actual live endpoint (evmAbiFilterGo) requires "abiJson" — empirically
+	#   confirmed: sending "abi" returns a 500, sending "abiJson" succeeds.
+	#   The display name in the UI is "evmAbiFilter"; the internal PATCH path uses
+	#   "evmAbiFilterGo". Both discrepancies are QuickNode API inconsistencies.
+	# No pause/unpause needed — template updates are applied hot.
 	log "Updating template args via /template/evmAbiFilterGo endpoint..."
 	local update_response
 	update_response=$(curl_api -X PATCH "${QN_API_BASE}/${webhook_id}/template/evmAbiFilterGo" \