feat(api): DB-backed idempotency guard, avatar post-upload verification, stream tips visibility

[khalyaro]

Summary

Addresses four open issues across payment idempotency, avatar moderation/verification, and stream tip feed visibility.

#841 — DB-back the payment idempotency guard

• Replaced the in-memory Map in PaymentIdempotencyGuardService with a database-backed store (TransactionIdempotencyRecord, unique per owner+key) so records survive restarts and are shared across instances.
• Wired the guard into deposit.service.initiateDeposit and creator-payout.service.initiatePayout.
• Added duplicate-request tests (unit test for the guard + API-level idempotency test for deposits).

#843 — post-upload avatar verification

• Added getAvatarObject S3 helper and post-upload verification (real size / content-type / magic bytes) that runs in PATCH /api/users/me before an avatar is marked active, instead of trusting the client-declared content type.

#844 — wire (previously orphaned) avatar moderation service

• Wired moderateAvatarUpload into the avatar upload flow (�erifyAvatarUrl) and added tests, including a rejection case for uploaded bytes that don't match the declared image type.

#845 — confirm stream tips visibility

• Confirmed GET /api/streams/:id/tips (SSE) already enforces
  equireAuth; documented it as intentionally private in stream.routes.ts.

Notes

• Adds a new Prisma model (TransactionIdempotencyRecord); run prisma generate + a migration before compiling/tests.

Closes

Closes #841
Closes #843
Closes #844
Closes #845

[drips-wave]

@khalyaro Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits