Summary

This PR implements backend system optimization for SEP-10 Authentication and SEP-12 KYC Integration across four related issues:

• [Backend] Enhance error recovery for SEP-10 Authentication #587 — Enhanced error recovery for SEP-10 Authentication (structured errors, transient store retries, safe XDR validation)
• [Backend] Conduct security audit on SEP-10 Authentication #588 — Security audit on SEP-10 Authentication (home-domain consistency, XDR size guards, nonce replay, audit documentation)
• [Backend] Implement rate limiting for SEP-12 KYC Integration #589 — Rate limiting for SEP-12 KYC Integration (write limiter test coverage, env documentation)
• [Backend] Implement rate limiting for SEP-10 Authentication #733 — Rate limiting for SEP-10 Authentication (account+IP challenge limits, per-IP verify limits, Redis-backed store)

Key changes

• backend/src/lib/sep10-auth.js — Sep10AuthError, withSep10StoreRecovery, validateChallengeXdr, getHomeDomain(), structured verification codes
• backend/src/lib/rate-limit.js — createSep10ChallengeRateLimit / createSep10VerifyRateLimit factories
• backend/src/routes/auth.js — Refactored to injectable createAuthRouter with wired rate limiters
• backend/src/app.js — Redis store for SEP-10 rate limits (rl:sep10: prefix)
• backend/SEP10_AUTH_SECURITY_AUDIT.md — Security audit findings and mitigations
• backend/.env.example — SEP-10 and SEP-12 rate limit env vars

Closes #587
Closes #588
Closes #589
Closes #733

Test plan

• npm --prefix backend test -- src/lib/sep10-auth.test.js src/routes/auth.routes.test.js src/lib/rate-limit.test.js src/routes/sep12.test.js (35 passed)
• Challenge endpoint rate-limits repeated requests for the same account
• Verify endpoint returns retryable 503 on transient store failures
• SEP-12 write endpoints rate-limit repeated PUT requests per account
• Confirm HOME_DOMAIN matches stellar.toml in staging

Security notes

• Challenge XDR capped at 8 KB before parsing
• Nonce replay protection rejects reused challenge transactions
• Home domain validated consistently on challenge generation and verification
• All challenge/verify attempts count toward rate limits (successful requests are not skipped)