feat: admin wallet allowlist guard

[KingFRANKHOOD]

Summary

Close #97
Adds an admin access control system based on a Stellar wallet allowlist. Any wallet that completes the normal nonce-and-signature flow currently has access to the full admin audit log via GET /admin/audit-logs. This PR gates all admin endpoints behind an AdminGuard that checks the authenticated wallet against a configurable allowlist.

Closes the admin access control gap identified in the codebase.

Changes

• New env var: \ADMIN_WALLETS\ — comma-separated Stellar public keys. Validated at startup; invalid entries cause immediate failure.
• New guard: \AdminGuard\ (src/auth/guards/admin.guard.ts) — resolves the authenticated wallet from
  eq.user\ and checks membership in the allowlist.
• Applied to: \AuditController\ (src/modules/admin/audit.controller.ts) — now requires both \JwtAuthGuard\ and \AdminGuard.
• Startup validation: \�alidateAdminWallets()\ called from \AppModule.onModuleInit\ — fails fast with a clear message on invalid Stellar addresses.
• Tests: 8 unit tests covering allowlisted wallet (200), non-allowlisted wallet (403), empty/unset allowlist (denies all), unauthenticated request, and response body non-disclosure.

Design Decisions

• Admin is NOT a role. Roles (\sponsor/ \�endor/ \mentor) are self-selected and permanent. Adding \�dmin\ to \USER_ROLES\ would be a privilege escalation — anyone could claim it. Admin status derives from the allowlist only.
• Empty = deny all. An unset or empty \ADMIN_WALLETS\ denies all admin access rather than granting it. This is the safe default for a config mistake.
• Generic 403 body. The response does not leak the allowlist contents or size.
• Follows existing patterns. Guard structure mirrors \RolesGuard. Stellar address validation uses \StrKey.isValidEd25519PublicKey\ (same as auth.service.ts). Logging uses \Logger\ from @nestjs/common.

Controller Audit

Audited all 16 controllers for endpoints assuming administrator access without enforcement:

Controller	Route prefix	Result
AuditController	/admin	Fixed — AdminGuard added
VendorsController	/vendors	All self-service (vendor manages own data)
LoansController	/loans	All user-facing (quote, create, repay)
SponsorsController	/sponsors	Self-service sponsor operations
LiquidityController	/liquidity	Role-gated (sponsor only)
UsersController	/users	Self-service profile; role-setting is USER_ROLES-validated
VouchingController	/vouching	Mentor/sponsor operations
TransactionsController	/transactions	User transaction history
NotificationsController	/notifications	User notifications
ReputationController	/reputation	Public reputation reads
HealthController	/health	Public health checks
MetricsController	/metrics	Public Prometheus metrics
AuthController	/auth	Public auth endpoints
StellarTomlController	/.well-known	Public stellar.toml
IndexerController	/indexer	Internal health check

No other controllers have endpoints that assume administrator access. Vendor approval, protocol pause, and parameter governance (mentioned in the issue) do not yet exist as endpoints — this PR establishes the admin guard infrastructure for when they are built.

Testing

• 
  pm run build\ — zero TypeScript errors
• 
  pm run lint\ — zero lint errors
• 
  pm test\ — 325/325 tests pass (29 suites), no test count decrease
• 8 new tests for AdminGuard

Acceptance Criteria

• GET /admin/* returns 403 for authenticated wallet not on allowlist
• GET /admin/* returns 401 for unauthenticated request (JwtAuthGuard handles this)
• Unset or empty ADMIN_WALLETS denies all admin access
• Startup fails with clear message if any allowlist entry is not a valid Stellar address
• No admin address hardcoded in any service file
• Admin is not added to USER_ROLES and cannot be self-assigned
• 403 response body does not disclose allowlist contents or size
• All state-changing operations validated and safe against invalid input

Files Changed

File	Action
src/config/env.ts	Added \�alidateAdminWallets()\ and \getAdminWallets()\
src/auth/guards/admin.guard.ts	New — AdminGuard implementation
src/modules/admin/audit.controller.ts	Added AdminGuard to @UseGuards
src/app.module.ts	Added OnModuleInit to call validateAdminWallets at startup
.env.example	Documented ADMIN_WALLETS variable
test/unit/modules/auth/admin.guard.spec.ts	New — 8 unit tests

[EmeditWeb]

nice work, kudos