Fix/issue 139 and issue 142 security hardening

[olathedev]

Title: fix runtime crashes and harden backend security

closes #142

Body:

Summary

• **Fixes ISSUE-04 · 🟠 HIGH — Backend Security Hardening (Rate Limiting + Auth Guards + Stub Endpoints) #142 — hardens auth rate limiting, locks down payment endpoints, and replaces four stub artisan endpoints with real DB operations

Changes

Issue 139 — Runtime Crashes

• schemas/user.py: add missing Enum import alongside StrEnum
• core/config.py: add SOROBAN_NETWORK_PASSPHRASE and BACKEND_SECRET_KEY settings; fix 8-space indentation in Soroban block
• services/soroban.py: replace module-level SorobanServer() and Keypair.from_secret() calls with lazy helpers (_get_soroban_server, _get_backend_signer) — importing the module without Stellar secrets configured no longer crashes the app

Issue #142 — Security Hardening

• Rate limiting (slowapi): /auth/login 5/min, /auth/register 3/hr, /auth/refresh 10/min; returns HTTP 429 + Retry-After on breach; adds SlowAPIMiddleware to main.py; adds slowapi to requirements.txt
• Payment auth guards: POST /payments/release and /payments/refund now require Depends(require_admin); admin user_id is logged on each action
• Stub endpoints replaced with real DB operations:
  • DELETE /artisans/{id} — deletes from DB, returns 404 if not found
  • PUT /artisans/availability — updates is_available using new AvailabilityUpdate schema (replaces raw dict)
  • GET /artisans/my-portfolio — queries actual Portfolio records for the current artisan
  • POST /artisans/portfolio/add — creates a Portfolio record using new PortfolioItemAdd schema; returns 201

Test plan

• python -c "from app.schemas.user import RegisterRequest" succeeds
• python -c "from app.services.soroban import invoke_contract_function" succeeds without Stellar secrets
• Unauthenticated POST /payments/release and /payments/refund return 401
• Non-admin calls to those endpoints return 403
• DELETE /artisans/{id} removes record (subsequent GET returns 404)
• PUT /artisans/availability persists is_available change to DB
• Portfolio add/read endpoints create and return real records
• 6+ rapid login attempts trigger HTTP 429
• All existing pytest tests pass (pytest)
• New tests pass: test_rate_limiting.py, test_payment_auth_guards.py, test_stub_endpoints.py

[gabito1451]

please look in to ci @olathedev also resolve conflicts