feat(wallet): add custodial wallet persistence, status transitions, and KMS references

[DhruvC-2938]

Why This PR Exists

Learnault requires managed Stellar custodial wallet persistence without storing plaintext private signing keys or seeds in the database, API payloads, or audit logs. This PR establishes non-custodial-at-rest wallet persistence and KMS reference models backed by an envelope-encrypted Key Management Service abstraction. It enforces strict database uniqueness constraints, explicit state transition guards, and zero plaintext secret leakage across all application layers.

What Was Wrong

Area	Problem
Secret Storage Risk	Plaintext Stellar private seeds could inadvertently be stored in persistence or leaked in logs/DTO responses without an explicit KMS reference model.
State Transitions	Wallet statuses lacked a formalized legal transition graph, permitting out-of-order state jumps and unvalidated transitions.
Uniqueness & Isolation	Incomplete enforcement of 1:1 user-to-wallet and 1:1 wallet-to-key-reference constraints risked duplicate key assignments or orphaned signing references.

What This PR Does

• Wallet & Managed Key Schema (prisma/schema.prisma, migration.sql) — Defined Wallet and ManagedKeyReference models storing only network, custody, public key, status, and opaque KMS URIs (kms://...) with unique constraints on userId, publicKey, managedKeyReferenceId, and opaqueReference.
• KMS Secret Store & Envelope Fake (src/services/kms/) — Implemented SensitiveValue (private #value with .toString()/.toJSON() redaction), KmsSecretStore interface, and InMemoryEnvelopeKms utilizing AES-256-GCM envelope encryption with test lifecycle hooks.
• State Machine & Transition Guards (src/types/wallet-provisioning.types.ts) — Extended WALLET_STATUSES with full lifecycle states (RESERVED, PROVISIONING, RETRYABLE, ACTIVE, EXPORTING, MIGRATED, FAILED, DISABLED) and added WALLET_TRANSITIONS map with canTransitionWallet() and assertValidWalletTransition() guards.
• DTO Redaction (src/types/wallet-provisioning.types.ts) — Enforced that PublicWallet and toPublicWallet() strictly exclude all internal KMS references (managedKeyReferenceId, opaqueReference, keyVersion).
• Unit & Secret Scanning Tests (tests/unit/wallet-transitions.test.ts, tests/wallet-secret-scan.test.ts) — Added comprehensive unit tests for all valid/invalid transitions and regex/AST scanning ensuring zero plaintext secret columns in schema and DTOs.

Testing

• tests/unit/wallet-transitions.test.ts — Passed (valid lifecycle paths, invalid jumps, and guard exceptions verified)
• tests/wallet-secret-scan.test.ts — Passed (0 plaintext secret columns, 0 leaked seeds in docs/DTOs)
• tests/wallet-provisioning.service.test.ts — Passed (concurrent reservations, KMS idempotency, DB finalization recovery)
• tests/wallet-self-custody-export.service.test.ts — Passed (step-up auth, KMS secret delivery, custody migration, KMS key deletion)

Out of Scope

• Production AWS KMS / Vault / HSM driver implementation (mock and envelope fake implemented for Phase 1).
• Unmounting of draft self-custody export routes until session identifiers land.

Closes #135

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.