fix: resolve issues #129, #149, #165 - BatchWallet duplicate handling, Pin Gist API wiring, Terraform backend

[gbengaeben]

Summary

This PR resolves three open issues assigned to @gbengaeben:

Closes #129 — BatchWallet: convert duplicate-within-batch panic into per-item Failure

• Problem: batch_create_wallets panicked when the same WalletCreateRequest appeared twice in one batch, making the operation atomic-or-nothing.
• Fix: Replaced the separate pre-scan/panic loop with inline duplicate detection during processing. Duplicates now return WalletCreateResult::Failure(owner, DuplicateWallet) instead of panicking, allowing partial success for the rest of the batch.
• Test: Added test_batch_create_wallets_partial_success_with_duplicates that verifies 5 requests with 2 duplicates yields 3 successes and 2 failures with DuplicateWallet error code.
• Files: contracts/batch-wallet/src/lib.rs

Closes #149 — Wire Pin Gist form to real API with optimistic update

• Problem: Map.tsx handleAddGist only appended to local state — no network call was sent.
• Fix:
  • Created Frontend/src/api/gists.ts with typed postGist() function calling POST /gists
  • Updated handleAddGist in Map.tsx to use optimistic insert: immediately add to local state, then replace with server-confirmed gist on success, or rollback on error
  • Added animated toast notifications for success/error feedback
  • Updated AddGistModal.tsx to use proper async loading flow (removed fake 2s timeout)
• Tests: Updated AddGistModal.test.tsx to handle the async handler (all 9 tests pass)
• Files: Frontend/src/api/gists.ts (new), Frontend/src/components/map/Map.tsx, Frontend/src/components/map/AddGistModal.tsx, Frontend/src/components/map/AddGistModal.test.tsx

Closes #165 — Configure Terraform remote state + DynamoDB lock

• Problem: No explicit S3 backend resources, no state-lock lifecycle, and no KMS encryption.
• Fix:
  • Created infrastructure/terraform/backend.tf with:
    • S3 bucket for remote state with versioning and KMS-SSE encryption
    • DynamoDB table for state locking (PAY_PER_REQUEST, PITR, SSE)
    • KMS key with key rotation for state encryption
    • Lifecycle rules: keep 10 noncurrent versions for 90 days, abort stale multipart uploads after 7 days
  • Moved the terraform { backend "s3" { ... } } block from providers.tf to backend.tf
  • Used unique data.aws_caller_identity.state_backend to avoid collision with the conditional data source in backup-vaults.tf
• Note: The backend block is initially commented out to support the standard bootstrap flow (create resources first, then terraform init -migrate-state)
• Files: infrastructure/terraform/backend.tf (new), infrastructure/terraform/providers.tf

Verification

• ✅ cargo check --target wasm32-unknown-unknown -p batch-wallet — compiles cleanly
• ✅ npx tsc --noEmit — no new TypeScript errors
• ✅ npx vitest run — 71 tests pass (1 pre-existing unrelated test issue in Features.test.tsx)
• ✅ All AddGistModal tests updated and passing (9/9)