feat: add shared Stellar address validation utility

[ebubechi-ihediwa]

Closes #267

Summary

Centralizes wallet-address format validation, which was duplicated and inconsistent across the auth, bet, and user surfaces. Adds a single shared utility used by Zod schemas and route guards so every wallet-related endpoint accepts/rejects the exact same set of addresses.

What changed

New src/utils/stellar-address.util.ts

• isValidStellarAddress(address: unknown) — safe predicate; non-strings/empty/malformed → false (never throws), so it's usable directly on route params.
• stellarAddressSchema / optionalStellarAddressSchema — reusable Zod schemas.
• validateStellarAddressParam(paramName) — Express route guard that rejects an invalid :address path param with 400 VALIDATION_ERROR via the centralized error handler.

Dependency boundary

• The raw StrKey.isValidEd25519PublicKey check stays in services/stellar.service — the single @stellar/stellar-sdk boundary that the test suite already mocks. The util delegates to it rather than importing the SDK a second time, so the SDK stays mockable and out of jest's ESM path.

Wired in (major routes)

• auth.schema and bets.schema now source validation from the shared util (removing their local copies).
• user.routes.ts param routes — /:address/stats, /:address/history, /:walletAddress/public-profile — now guard the address and return 400 on malformed input (previously unvalidated; passed straight to Soroban/Prisma).
• stellar.service.verifySignature and the hackathon user.ts reuse the shared helper.

Acceptance criteria

• ✅ Invalid addresses rejected with 400 (route guards + schema refinements).
• ✅ Shared helper used in the major auth/bet/user routes.
• ✅ Wallet-related endpoints behave consistently (one validator).

Testing

• New src/tests/stellar-address.util.spec.ts — 11 tests: predicate edge cases (non-string/empty/throwing), the Zod schema (valid/invalid/required/optional), and the route guard's 400 behavior + custom param name. stellar.service is mocked (as the other suites do) so the SDK stays out of jest.
• Verified against a measured baseline: zero new test failures. The pre-existing failures in bets.routes, hackathon-bets, hackathon-endpoints, and route-parity are unrelated environmental issues (jest cannot parse @stellar/stellar-sdk's ESM under pnpm) / stale post-feat: mount production user, bet, and tournament routes in hackathon app #363 route-mounting expectations — they fail identically with and without this change. tsc shows no new errors.

🤖 Generated with Claude Code