feat(payment-requests) & fix(auth): restore payment-request.v1 contract and public validate endpoint (#30)

[cLamberti]

Closes #30

---

Description

Implements S08 (#30): restores the canonical payment-request.v1 contract and exposes the
public POST /v1/payment-requests/validate endpoint. Also includes a required fix to the
auth module (S03) that was leaving the lint and test:e2e jobs red on develop (see
"Changes made").

Type of change

• New feature (feat)
• Bug fix (fix)
• Refactor / internal improvement
• Database migration (Prisma)
• Documentation
• Tests
• Other:

Changes made

S08 (#30):

• SRV-031/032/033 — Restored docs/payment-request.v1.md and src/contracts/payment-request.v1.{ts,spec.ts} from 5d4e9de^, ported unchanged. The contract ships 13 PAYMENT_REQUEST_* error codes; the issue's Appendix A (7) is a subset.
• SRV-034 — Added PaymentRequestsModule and registered it in AppModule.
• SRV-035 — Public POST /v1/payment-requests/validate (@Public()), HTTP 200 for both valid and invalid payloads, response { valid, normalized, errors }. Raw body (no DTO); validation is fully delegated to the contract, so unknown fields return 200 with PAYMENT_REQUEST_FIELD_UNKNOWN, not 400.
• Minimal Swagger (@ApiBody with example + @ApiOkResponse); rich schema deferred to SRV-036.

Out of scope, deferred: request persistence (SRV-038), rate limiting (S18), detailed DTO/Swagger (SRV-036).

Auth fix (outside S08 scope, authorized by the maintainer):

• SupabaseStrategy: secret → secretOrKey (passport-jwt 4.x crashed AppModule bootstrap with "requires a secret or key").
• Fixed 18 lint errors in src/auth/ (typed the CurrentUser decorator and its spec, referenced the jest mock directly in the guard spec).
• test/app.e2e-spec.ts: mock PrismaService so bootstrap tests run without a live database (CI does not spin up Postgres).

Test plan

• Unit: 46 tests (contract + service + controller) — green.
• Unit / e2e tests updated or added (e2e: 7 tests, including HTTP golden vectors — unsupported asset, non-Stellar recipient, past expiry, unknown field → 200 — and unauthenticated access).
• Tested locally with npm run start:dev: verified by hand against the running server (Swagger) — valid:true with normalized, and ASSET_UNSUPPORTED / FIELD_UNKNOWN / TIMESTAMP_OUT_OF_WINDOW all correct.
• Full CI matrix green: npm ci, eslint, prettier --check ., tsc --noEmit, build, test (46), test:e2e (7). Added .prettierignore for vendored/docs dirs so the repo-wide format check passes.
• Repo-wide prettier --check . is pre-existing red on develop (95 tracked vendored files under .agents/, .claude/, docs/, README.md, eslint.config.mjs — none touched by this PR).

Migrations / database

N/A

Checklist

• I included Closes #30 with the correct issue number
• Code follows project conventions (NestJS, modules, etc.)
• npm run lint and npm run test pass without errors
• Prisma migrations generated and tested (if applicable) — N/A, no schema changes
• Updated documentation if the change requires it — restored docs/payment-request.v1.md

Screenshots

[cLamberti]

@JoelVR17
The S08 work is complete and green locally, but I ran into several CI problems along the way

eslint, tsc, build, unit (46) and e2e (7) all pass; verified the endpoint by hand against a running server.
Pre-existing issues I hit (not caused by S08):

npm ci - passes locally on Windows, fails on the Linux CI runner. The committed package-lock.json is valid for the platform it was generated on (Windows) but not for Linux: on CI it errors with Missing: @emnapi/core@1.11.2 …. These are platform-specific optional deps pulled transitively by unrs-resolver (ESLint tooling). Same lockfile, npm ci green on Windows and red on Linux . And it can't be regenerated correctly from a Windows machine (Windows npm only records the win32 binding).

Node version — CI uses Node 20, but @stellar/stellar-sdk@16.0.1 requires Node >=22 (EBADENGINE warning).

Questions:

Was CI already red on develop before this PR?

[JoelVR17]

@JoelVR17 The S08 work is complete and green locally, but I ran into several CI problems along the way

eslint, tsc, build, unit (46) and e2e (7) all pass; verified the endpoint by hand against a running server. Pre-existing issues I hit (not caused by S08):

npm ci - passes locally on Windows, fails on the Linux CI runner. The committed package-lock.json is valid for the platform it was generated on (Windows) but not for Linux: on CI it errors with Missing: @emnapi/core@1.11.2 …. These are platform-specific optional deps pulled transitively by unrs-resolver (ESLint tooling). Same lockfile, npm ci green on Windows and red on Linux . And it can't be regenerated correctly from a Windows machine (Windows npm only records the win32 binding).

Node version — CI uses Node 20, but @stellar/stellar-sdk@16.0.1 requires Node >=22 (EBADENGINE warning).

Questions:

Was CI already red on develop before this PR?

Hey @cLamberti!

Great to see you again in GrantFox

Yes, the error was before this PR, so don't worry, Ill fix it locally. Thanks for your effort

[cLamberti]

@JoelVR17 The S08 work is complete and green locally, but I ran into several CI problems along the way
eslint, tsc, build, unit (46) and e2e (7) all pass; verified the endpoint by hand against a running server. Pre-existing issues I hit (not caused by S08):
npm ci - passes locally on Windows, fails on the Linux CI runner. The committed package-lock.json is valid for the platform it was generated on (Windows) but not for Linux: on CI it errors with Missing: @emnapi/core@1.11.2 …. These are platform-specific optional deps pulled transitively by unrs-resolver (ESLint tooling). Same lockfile, npm ci green on Windows and red on Linux . And it can't be regenerated correctly from a Windows machine (Windows npm only records the win32 binding).
Node version — CI uses Node 20, but @stellar/stellar-sdk@16.0.1 requires Node >=22 (EBADENGINE warning).
Questions:
Was CI already red on develop before this PR?

Hey @cLamberti!

Great to see you again in GrantFox

Yes, the error was before this PR, so don't worry, Ill fix it locally. Thanks for your effort

@JoelVR17 Thanks for confirming, and for the opportunity to contribute to your repo!

Pura vida 🙌