refactor: simplify rate limiter and enhance frontend error handling

[Folex1275]

Summary

Fixes four bugs across the rate limiter middleware and transaction history
component.

---

fix(rateLimiter): remove redundant whitelist check in default export (#227)

The default rateLimiter export manually called isWhitelisted() before
delegating to createRateLimiter(), which already has a skip option that
calls isWhitelisted(). This caused every whitelisted IP to be checked twice
per request.

Replaced the hand-rolled wrapper function with a single pre-built
createRateLimiter() instance as the default export. The skip option inside
createRateLimiter is now the sole whitelist gate.

Closes #227

---

fix(TransactionHistory): surface fetch errors instead of swallowing them (#228)

The fetchPage catch block was empty, leaving the component stuck in a loading
state with no feedback when the API call failed. The parent App component
does not handle errors from TransactionHistory, so errors were silently lost.

Added an error state that captures the error message. When set, an error
banner with a Retry button is rendered in place of the transaction list.
Retrying re-fetches the current page (preserving cursor position).

Closes #228

---

fix(TransactionHistory): cap cursor history to prevent unbounded growth (#229)

The cursors array grew by one entry on every "Next" click with no upper
bound. After navigating many pages the array could hold hundreds of cursor
strings in memory.

Capped the cursor stack at 50 entries (MAX_CURSOR_HISTORY). When the limit
is exceeded, the oldest entry is dropped (sliding window), so back-navigation
still works for the most recent 50 pages.

Closes #229

---

fix(App): abort axios request when withTimeout fires (#230)

withTimeout previously raced a setTimeout rejection against the axios
promise. When the timeout won, the axios request continued running in the
background, consuming bandwidth and potentially resolving after the user had
already seen an error.

Refactored withTimeout to accept a factory function (signal) => promise.
It creates an AbortController, passes the signal to axios via the signal
option, and calls controller.abort() when the timeout fires. Updated all
three call sites (createAccount, checkBalance, sendPayment) accordingly.
Also removed a duplicate const { data } declaration in sendPayment that
was left over from a previous edit.

Closes #230

[drips-wave]

@Folex1275 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits