feat(payments): SEP-10 Stellar Web Authentication server: challenge a…

[affy-exe]

…nd verify endpoints

Adds generic SEP-10 infrastructure (ADR 0005 step 4, issue #77): before a patient or facility wallet can be trusted as payer or payee, the backend must prove the caller controls that Stellar address.

• GET /payments/sep10/challenge?account=G… — authenticated + verified email; full strkey checksum validation; builds a server-signed challenge via @stellar/stellar-sdk WebAuth helpers (Manage Data nonce, 5-minute time bounds, home domain + web_auth_domain) and records the issuance binding (userId, account, nonce, expiresAt).
• POST /payments/sep10/verify — walks the SEP-10 server verification list (structure, sequence 0, server source, time bounds, operation shape, server signature), then client signatures: multisig weight thresholds loaded from Horizon via verifyChallengeTxThreshold, or the spec's master-key rule for unfunded accounts via verifyChallengeTxSigners. Bound to the authenticated user and account; nonce consumed with ONE conditional UPDATE so concurrent replays can't both succeed.
• New Sep10Challenge model (unique nonce, userId, account, expiresAt, consumedAt, createdAt, index on expiresAt) + migration.
• Dedicated SEP10_SIGNING_SECRET config, separate from payer/releaser keys, validated at startup (names vars, never secrets), documented in .env.example.
• Horizon access sits behind an injectable seam, so 15 unit + 18 integration tests cover happy path, replay, concurrency, expiry, wrong signer, multisig thresholds, unfunded accounts, user/account binding and tampering with zero network.

Docs: ARCHITECTURE.md §4.10, ARCHITECTURE_ESSENTIALS.md data-model map, ROADMAP.md Phase 5.5 + changelog, docs/api/README.md endpoint reference.

Closes #77

[drips-wave]

@affy-exe Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[afeezorobsco-cyber]

@affy-exe fix CI

[afeezorobsco-cyber]

CI is failing on this PR. main itself is green, so the cause is in this branch:

Integration tests fail: tests/integration/access-control.test.mts, the access-control suite that #147 added to main, fails with this branch merged (86 tests skipped after the suite errors). Run npm run test:integration -- access-control locally to see which of your new payment or wallet routes breaks the suite's expectations. Every route that exposes payment data needs to be covered by it.

Please push a fix and CI will re-run. Before pushing, run npm run prisma:generate && npm run typecheck && npm test && npm run test:integration in backend/.

[afeezorobsco-cyber]

@affy-exe

CI fails in tests/integration/access-control.test.mts with Hook timed out in 10000ms (the setup hook didn't finish). That suite has changed on main since this branch was cut, and this PR now conflicts with main too. Please rebase onto the latest main (or merge main into your branch), resolve the conflicts, and push. If it still times out after rebasing, run the suite locally. The new SEP-10 code may be making a network call (e.g. a Horizon/RPC lookup) during app setup.

[afeezorobsco-cyber]

@affy-exe Thanks for the PR. It can't be merged yet. To unblock it:

CI is failing. Here's what broke:

Backend (typecheck + test + build):

prisma generate: P1012 Error validating field `user` in model `Sep10Challenge`: the relation is missing an opposite relation field on model `User` (prisma/schema.prisma:573)

Please fix these errors and run the same steps locally before pushing (npm run typecheck && npm test && npm run build, or cargo test for contracts).

Merge conflicts: this branch conflicts with main. Please rebase onto the latest main (git fetch upstream && git rebase upstream/main), resolve the conflicts (often ROADMAP.md, ARCHITECTURE*.md or prisma/schema.prisma), and force-push.

Push to this same branch and CI will re-run. Once it's green and conflict-free, it'll be reviewed for merge.