protect admin endpoints with wallet allowlist

[Obiajulu-gif]

Related Issue

Closes #97

---

Title

Protect privileged API endpoints with a fail-closed wallet allowlist.

---

Description

The audit-log endpoint previously required only a normal user JWT, so any authenticated wallet could read privileged audit data. This change introduces the shared admin authorization primitive required by vendor governance and other protocol operations.

Problem this solves

Admin status cannot safely be a self-selected user role. The API now derives it exclusively from a startup-validated ADMIN_WALLETS allowlist, and empty configuration denies all admin access.

---

Changes Made

• Added AdminGuard with a generic 403 response and wallet-scoped rejection logging.
• Added startup validation for comma-separated Stellar public keys and documented fail-closed behavior.
• Applied JwtAuthGuard and AdminGuard to the audit controller with full 401/403 Swagger responses.
• Audited all controllers; no other controller currently exposes an admin-assuming route.
• Added guard and environment validation tests and updated the progress tracker.

---

Screenshots

Not applicable; this is an API/security change.

---

How it was tested

• npm run build — zero TypeScript errors
• npm test -- --runInBand — 30 suites, 325 tests passed
• Focused guard/config/JWT tests — 14 tests passed
• ESLint on every changed TypeScript file
• git diff --cached --check

Additional Notes

admin was not added to USER_ROLES; wallet-bound roles remain self-selectable and cannot grant administrative access. No admin address is hardcoded.