feat: implement Stellar SEP-24 Interactive Deposit and Withdrawal Protocol Flow (#269)

[abdulrahamza]

Summary

This PR implements full support for the Stellar SEP-24 Interactive Deposit and Withdrawal Protocol standard in AfroPay-Stellar (#269). It enables AfroPay to operate as a compliant Stellar anchor and integrate with third-party wallets (e.g. LOBSTR, Vibrant) via an interactive webview flow for identity (KYC) data capture and payment details selection, backed by NestJS REST endpoints, JWT webview session authentication, and PostgreSQL state management.

Type of change

• Bug fix
• New feature
• Documentation
• Refactor or maintenance
• Smart contract change

Related issue

Closes #269

Scope and impact

• Frontend
• Backend or API
• Soroban contract
• Database or migration
• Documentation only

Testing

• Tested locally on Testnet, or not applicable
• No TypeScript / Rust errors, or not applicable
• Docs updated if needed, or not applicable

Database / Schema Impact:

• Added Sep24TransactionStatus enum and Sep24Transaction model in apps/api/prisma/schema.prisma to track interactive deposit/withdraw session states (incomplete → pending_user_transfer_start).

API Compatibility Impact:

• Introduced new REST controller endpoints under /sep24 (/sep24/transactions/deposit/interactive, /sep24/transactions/withdraw/interactive, /sep24/transaction, /sep24/transactions, /sep24/info, /sep24/interactive/session, /sep24/interactive/confirm).
• Fully backward compatible with zero breaking changes to existing endpoints or contracts.

Validation

• Unit or integration tests run, or not applicable with an explanation
• Frontend accessibility checked, or not applicable
• Backend/API behavior checked, or not applicable
• Soroban contract tests and clippy run, or not applicable
• Documentation and examples checked

Test Execution Results:

• Backend Unit & Integration Tests (apps/api): sep24.service.spec.ts (17 passed) & sep24.controller.spec.ts (10 passed) — Total: 27 passed, 0 failed.
• Frontend Vitest Tests (apps/frontend): interactive.test.tsx (10 passed) — Total: 10 passed, 0 failed.

Compatibility and operations

• No breaking changes
• Breaking changes are documented below
• Database or storage migrations are backward compatible, or the migration plan is documented below
• Deployment, configuration, or rollback notes are included below when needed

Configuration Notes:

• JWT_SECRET must be set in apps/api environment configuration (minimum 32 chars).
• NEXT_PUBLIC_API_URL must point to the NestJS API base URL in apps/frontend environment configuration.

Screenshots

Not applicable

Additional context

• Implemented window.parent.postMessage callback protocol with event sep24:interactive_complete to notify parent wallet webviews upon session completion.
• Session JWT tokens are time-limited (30 minutes TTL) and single-use, preventing replay or expired session submissions.

[vercel]

@abdulrahamza is attempting to deploy a commit to the milah's projects Team on Vercel.

A member of the Team first needs to authorize it.