Multi-currency Phase 4 — rate fetcher with Kraken/Coinbase/CoinGecko fallback

src/rates.rs adds an in-memory rate cache (60s TTL) with a 3-source
fallback chain. AppState gains `rates: Arc<RateCache>`. Manual pins
via the settings table override the chain — used by tests for
deterministic conversions and by operators during maintenance
windows.

Admin endpoints:
- GET /v1/admin/rates: cache snapshot
- POST /v1/admin/rates/refresh: force re-fetch (audit-logged)

Two new tests (network-free, manual-pin path):
- rate_cache_honors_manual_pin_from_settings
- admin_rates_endpoint_reflects_manual_pin

Test count: 36 (was 34).

licensing-service/tests/worker.rs

@@ -69,6 +69,7 @@ async fn make_state() -> (AppState, NamedTempFile) {
         self_tier: Arc::new(RwLock::new(Tier::Unlicensed {
             reason: "test".into(),
         })),
+        rates: keysat::rates::RateCache::new(),
     };
     (state, tmp)
 }