feat: implement POST /analyze/wasm endpoint with spawn_blocking

[System625]

Closes #6

Adds POST /analyze/wasm — accepts base64-encoded WASM bytes, a function
name, and optional args, then returns a ResourceReport with CPU/RAM
metrics.

Changes

• simulation.rs: adds profile_contract (sync) using soroban_sdk::Env
  for local simulation
• main.rs: adds AnalyzeWasmRequest, analyze_wasm handler, route under JWT auth middleware, and OpenAPI registration

Soroban simulation is CPU-intensive; tokio::task::spawn_blocking keeps
the async runtime unblocked during analysis.

[drips-wave]

@System625 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[GideonBature]

ACK