fix: address 4 review findings in SuiBets exchange integration

[elpou88]

Summary

Addresses all 4 findings from the code review of the SuiBets exchange integration.

---

Finding 1 — Hardcoded localhost URL → production URL

config.ts, api.ts, normalizer.ts, index.ts

All references to http://localhost:8080 replaced with https://www.suibets.com.
Added ALLOWED_HOSTS allowlist + validateBaseUrl() SSRF guard.

Finding 2 — HTML-response detection in error mapper

errors.ts

extractErrorMessage now detects when the response body is an HTML string (Cloudflare / nginx error page) and returns a human-readable [status] Server returned HTML instead of JSON message instead of leaking raw HTML into the error.

Finding 3 — Type guard + typed return for fetchRawPositions

fetcher.ts

• Added isSuibetsRawOffer(value: unknown): value is SuibetsRawOffer type guard
• fetchRawPositions now returns SuibetsRawPositions (typed struct) instead of unknown[]
• createdOffers filtered through the guard before normalisation — prevents silent garbage output when matchedBets/parlays arrays are accidentally passed as offers

Finding 4 — SuiBetsOptions interface + walletAddress in SDK client

sdks/typescript/pmxt/client.ts

• Added SuiBetsOptions interface with optional walletAddress and baseUrl
• Wired through to SuiBetsExchange constructor so callers can pass a Sui wallet address for position fetching without casting

---

All changes are backwards-compatible. No new dependencies.