expose vendor approval and suspension endpoints

[Obiajulu-gif]

Summary

Closes #98

Adds the missing admin-driven vendor approval lifecycle: guarded endpoints return unsigned Soroban XDR, while local vendor status changes only after the existing transaction checker confirms the signed operation on Stellar.

Stacked dependency: this draft includes the exact two commits from #104 (AdminGuard). Once #104 merges, this PR's diff will reduce to the vendor lifecycle commit only.

This repo is for the NestJS backend API only

• My changes are inside src/, test/, supabase/migrations/, and the required progress tracker
• I have NOT added React, React Native, or frontend component files
• I have NOT added Rust or modified Soroban contract code
• This is NestJS/TypeScript backend work

Type of change

• Bug fix
• New endpoint
• New service or module
• Database migration
• Background job integration
• Test coverage

What changed

• Added a timestamped migration with pending, approved, suspended, and rejected vendor states and backfilled existing rows to pending.
• Added buildApproveVendorXdr(admin, vendor) and buildSuspendVendorXdr(admin, vendor) without server-side signing or submission.
• Added audited POST /vendors/:id/approve and POST /vendors/:id/suspend, guarded by JWT plus the shared admin allowlist.
• Added 409 transition validation before contract simulation and exposed status through vendor DTOs.
• Added vendor transaction types and confirmation follow-ups so Supabase status/verified fields change only after Horizon confirmation.
• Aligned contract reads with the deployed is_active and get_vendor_info function names.

Problem this solves

Vendors registered in Pending on-chain but the API had no write path to approve them, so every loan validation failed with VendorNotActive. Admins can now prepare the correct contract operations for wallet signing, and off-chain state cannot claim approval for a transaction that was never submitted or confirmed.

Testing

• npm run build passes with zero TypeScript errors
• npm test -- --runInBand passes — 33 suites, 335 tests
• No new any types introduced
• Full Swagger decorators added to both endpoints
• New timestamped migration included
• New unit tests cover XDR construction, state transitions, confirmation-only writes, guards, and audit metadata
• ESLint passes for every changed TypeScript file
• git diff --cached --check passes

Context files reviewed

• context/architecture-context.md
• context/code-standards.md
• context/progress-tracker.md updated
• All remaining context files reviewed
• Exact StepFi-Contracts vendor-registry signatures verified

Additional notes

No admin key is held server-side. The client signs the returned XDR and submits it through the existing transaction endpoint using vendor_approve or vendor_suspend as the transaction type.