Multi-currency Phase 4 — rate fetcher with Kraken/Coinbase/CoinGecko fallback

src/rates.rs adds an in-memory rate cache (60s TTL) with a 3-source
fallback chain. AppState gains `rates: Arc<RateCache>`. Manual pins
via the settings table override the chain — used by tests for
deterministic conversions and by operators during maintenance
windows.

Admin endpoints:
- GET /v1/admin/rates: cache snapshot
- POST /v1/admin/rates/refresh: force re-fetch (audit-logged)

Two new tests (network-free, manual-pin path):
- rate_cache_honors_manual_pin_from_settings
- admin_rates_endpoint_reflects_manual_pin

Test count: 36 (was 34).

licensing-service/src/main.rs

@@ -77,6 +77,7 @@ async fn main() -> anyhow::Result<()> {
         payment: Arc::new(tokio::sync::RwLock::new(provider)),
         config: Arc::new(cfg.clone()),
         self_tier,
+        rates: keysat::rates::RateCache::new(),
     };
 
     // Spawn background loops before handing state to the router.