test(api): cover refund service failure modes

[pengyuayn]

What

Adds focused unit coverage for the refund service failure paths and persistence side effects.

Why

Refunds are money-moving admin actions, so the service should be covered beyond the happy path. These tests document the existing behavior for duplicate refund requests, missing challenges/deposits, missing Horizon payment sender data, Stellar submission failures, and audit-log payloads.

How

• Asserts duplicate refund requests return the existing refund without sending another payment.
• Covers challenge-not-found, settled challenge, missing deposit, and missing deposit sender failures.
• Verifies source_account fallback when Horizon payment records omit from.
• Verifies the Stellar payment operation, refund memo, and audit-log payload on success.
• Ensures refund state is not persisted if Stellar submission fails.

Test plan

• ./node_modules/.bin/vitest run apps/api/src/services/refund.test.ts
• ./node_modules/.bin/prettier --check apps/api/src/services/refund.test.ts
• git diff --cached --no-color | node scripts/gitleaks.mjs detect --pipe --redact --config .gitleaks.toml --verbose
• ./node_modules/.bin/tsc -p apps/api/tsconfig.json --noEmit currently blocked by existing unrelated apps/api/src/routes/leaderboard.ts(196,1): error TS1128

Closes #399