Fix inactive API configuration cleanup

[mickeyslaven]

Fixes #2

Summary

• use the stored request activity timestamp when removing inactive API configurations
• preserve the existing cleanup timeout and request-limit behavior

Testing

• reproduced the issue locally by filling the configuration table, waiting 35 seconds, and confirming a new configuration still returned HTTP 400
• repeated the same test with this fix and confirmed the new configuration returned HTTP 200 after 35 seconds
• node --check src/server.js
• git diff --check