Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@packages/public-api/src/env.ts`:
- Around line 4-5: Replace the loose validator "const flag =
z.string().transform(v => v === 'true')" with a strict enum-based validator so
only the literals "true" or "false" are accepted; change the schema for the
feature-flag (the const named flag in this module) to use
z.enum(['true','false']) and then transform the validated string to a boolean
(e.g., .transform(v => v === 'true')), which will cause invalid values (like
"TRUE", "1", typos, or extra whitespace) to fail validation at startup instead
of silently mapping to false.
- Around line 8-9: Tighten the zod schemas for numeric and boolean env vars:
validate PORT and DEFAULT_AFFILIATE_BPS using a numeric regex (e.g.,
.regex(/^\d+$/, 'PORT must be numeric') / 'DEFAULT_AFFILIATE_BPS must be
numeric') instead of allowing any string, change all RATE_LIMIT_* fields to use
integer validation (e.g., .int().min(1) or similar) so empty strings or
non-numeric values fail validation, and update the feature flag fields
referenced around the feature flag block (lines 61-63 and 65-75) to explicitly
validate booleans (reject invalid strings rather than coercing to false) using
zod boolean parsing or a stricter pre-parse with .refine/.transform to produce
clear error messages; update the schema entries for PORT, DEFAULT_AFFILIATE_BPS,
each RATE_LIMIT_* key, and the feature flag keys accordingly.

In `@packages/public-api/src/routes/affiliate/getAffiliateStats.ts`:
- Around line 61-62: The code builds backendUrl using new
URL(`/swaps/affiliate-fees/${address}`, env.SWAP_SERVICE_BASE_URL) which drops
any service prefix in SWAP_SERVICE_BASE_URL; change it to build the endpoint
using string concatenation instead (e.g., combine env.SWAP_SERVICE_BASE_URL with
"/swaps/affiliate-fees/" + address) so the service prefix is preserved; update
the backendUrl assignment in getAffiliateStats.ts (the const backendUrl
variable) accordingly and ensure any subsequent usage expects a string or new
URL(...) constructed from the full concatenated string.