Fix: Add JWT authentication guard to admin-only endpoints

[ghost]

What

Implements Web3-style (Stellar signature) authentication for the CoopFinance API:

• src/modules/auth/auth.module.ts — wires up @nestjs/jwt with JWT_SECRET from config.
• src/modules/auth/auth.service.ts — in-memory nonce generation (5-minute TTL, keyed by address) and Stellar signature verification via Keypair.verify() from @stellar/stellar-sdk, plus JWT issuance.
• src/modules/auth/auth.controller.ts — GET /api/auth/nonce?address= and POST /api/auth/verify.
• src/modules/auth/jwt-auth.guard.ts — JwtAuthGuard validating the Authorization: Bearer <token> header.
• Applied JwtAuthGuard + @ApiBearerAuth() to POST /api/groups, POST /api/loans, and PATCH /api/loans/:id/status.
• Registered AuthModule in AppModule, and imported it into GroupsModule/LoansModule so the guard can resolve JwtService.
• Left GET /api/groups, GET /api/loans, and GET /api/stats public/unguarded.

Why

All write endpoints were publicly callable with no authentication, allowing anyone to register groups or submit/modify loans. Since CoopFinance is Stellar-native, we use signature-based auth (nonce + Keypair signature) rather than email/password, leveraging the already-installed @nestjs/jwt / @nestjs/passport / passport-jwt dependencies.

Testing

• Manual flow: GET /api/auth/nonce?address=<G...> returns a nonce string; sign it client-side with stellar-sdk's Keypair.sign(), base64-encode the signature, then POST /api/auth/verify with { address, signedNonce } returns { accessToken }.
• POST /api/groups, POST /api/loans, PATCH /api/loans/:id/status now return 401 without a valid Authorization: Bearer <token> header, and succeed with a valid token.
• GET /api/groups, GET /api/loans, GET /api/stats remain accessible without auth.
• Swagger UI (/api/docs) shows the bearer-auth lock icon on the guarded routes.

Closes #6