fix: route quickstart through flash service

[forge0x]

Summary

• Rename the quickstart app service from galoy to flash and render Apollo Router, Kratos, and Oathkeeper upstreams to http://flash:... instead of legacy Galoy/Bats service names.
• Pass Flash YAML config into the quickstart flash and trigger containers, including a quickstart-only overlay.
• Add a guarded quickstart IBEX mock for local bootstrap: it requires both ibex.mock: true in the quickstart overlay and FLASH_ENABLE_IBEX_MOCK=true in Compose, so normal environments still use real IBEX.
• Narrow quickstart.sh to a Flash public GraphQL smoke test instead of running the old Galoy BTC-wallet funding flow.
• Fix distroless image source asset permissions so the non-root runtime can read copied config/proto assets.

Note

The previous revision used galoy because that was the inherited Compose service name for the local app container. Dread was right to call that out: Flash quickstart should not encode Galoy service routing, and CI quickstart should not need real IBEX sandbox credentials.

Verification

• GALOY_QUICKSTART_PATH=./ docker compose -f quickstart/docker-compose.yml config --quiet
• bash -n quickstart/bin/re-render.sh quickstart/bin/quickstart.sh
• git diff --check
• ytt -f ./docker-compose.tmpl.yml -f galoy/docker-compose.yml -f galoy/docker-compose.override.yml | rg -n "/app/quickstart/config|FLASH_ENABLE_IBEX_MOCK|http://(galoy|bats-tests):|firebaseappcheck.googleapis.com/72279297366|projects/72279297366"
• Isolated local quickstart smoke with local Flash images and alternate host ports: GALOY_ENDPOINT=localhost:14002 COMPOSE_PROJECT_NAME=qs415ci ./bin/quickstart.sh → regtest, DONE