feat: add JWT auth guard with Stellar signature verification (Closes #6)

[ney9320]

/claim

Summary

Add JWT authentication guard with Stellar wallet-based signature verification. Write endpoints are now protected; read endpoints remain public.

Closes #6

Authentication Flow

1. GET /api/auth/nonce?address=G...    → { nonce, message }
2. Client signs `message` with Stellar private key (base64)
3. POST /api/auth/login { address, signature }  → { accessToken }
4. Subsequent requests: Authorization: Bearer <accessToken>

Files Created

src/modules/auth/

File	Purpose
auth.service.ts	Nonce generation, Stellar Keypair.verify() signature check, JWT issuance, in-memory nonce store (5min TTL, auto-purge)
auth.controller.ts	GET /api/auth/nonce, POST /api/auth/login
jwt.strategy.ts	Passport JWT strategy — extracts Bearer token, validates expiry
jwt-auth.guard.ts	NestJS AuthGuard('jwt') wrapper
auth.module.ts	JwtModule.registerAsync + PassportModule

Protected Endpoints

Method	Endpoint	Before	After
POST	/api/groups	Open	🔒 Requires JWT
POST	/api/loans	Open	🔒 Requires JWT
PATCH	/api/loans/:id/status	Open	🔒 Requires JWT
POST	/api/governance/proposals	Open	🔒 Requires JWT
POST	/api/groups/:groupId/members	Open	🔒 Requires JWT

All GET endpoints remain publicly accessible.

Design Decisions

• In-memory nonce store: 5-min TTL with automatic purge. Production should use Redis.
• JWT expiry: Configurable via JWT_EXPIRES_IN env var (default 24h).
• JWT secret: Configurable via JWT_SECRET env var.
• Signature format: Base64-encoded Stellar Ed25519 signature of the UTF-8 challenge message.
• @ApiBearerAuth(): Added to all protected routes for Swagger documentation.

Verification

• nest build: Auth module files compile with zero errors
• Pre-existing TS errors in stellar.service.ts and groups.service.ts are unrelated to this PR