Add property-based tests for Stellar addresses, hashes, amounts, timestamps, policies, postage, and receipts

Problem

The unit suite in tests/unit/api covers actor, domain, request, response, policy, postage, receipt, idempotency, and memory-repository behavior with example-based tests. Example tests can miss malformed Unicode, numeric boundaries, timestamp combinations, and unexpected object shapes that hand-picked examples don't happen to cover.

What this PR does

Adds fast-check as a devDependency and a shared arbitraries module (tests/unit/api/arbitraries.ts) that generates domain values mirroring the exact validation rules in src/server/api/domain.ts:

• Stellar addresses — valid canonical G[A-Z2-7]{55} addresses, whitespace/case-variant addresses that normalize correctly, and structurally invalid addresses (wrong prefix, wrong length, disallowed base32 characters).
• 32-byte hashes — valid/invalid hex hashes, including mixed-case normalization.
• Amount strings — non-negative integer strings up to the Soroban i128 boundary (2^127 - 1), plus invalid variants (negative, one past the boundary, leading zeros, non-numeric).
• Timestamps — UTC Z-suffixed instants (for postage.createdAt / idempotency records) versus offset-bearing instants (valid only for receipt fields), and receipt timestamp pairs that honor ordering + future-skew invariants.
• Composite records — mailbox policies, postage, and receipts built from the primitives above.

New property-test files (49 new tests total):

Acceptance criteria

• Generators cover valid and invalid values — every arbitrary above has a valid and an invalid counterpart, both exercised in tests.
• Failures report reproducible seeds — fast-check's default failure output includes { seed, path } plus a shrunk counterexample, so any CI failure can be reproduced locally by passing the same seed back into fc.assert.
• Critical numeric and timestamp invariants are asserted — i128 boundary (±1), delivery/read timestamp ordering, 5-minute future-skew boundary (inclusive), CAS exactly-one-winner under concurrency.
• The suite runs within a bounded CI time — numRuns is capped per property (60–200), and the full suite (151 files / 1766 tests, including these additions) runs in ~25–30s locally.

Verification

• bun install (regenerated bun.lockb / package-lock.json with the new fast-check devDependency)
• npx vitest run tests/unit — 151 files passed, 1766 tests passed, 3 expected fail (pre-existing)
• npx tsc --noEmit — no errors
• npx eslint tests/unit/api/arbitraries.ts tests/unit/api/*.properties.test.ts — no errors
• Manually confirmed a deliberately-failing property reports a reproducible { seed, path } and shrunk counterexample

Files changed

New:

• tests/unit/api/arbitraries.ts
• tests/unit/api/actor.properties.test.ts
• tests/unit/api/domain.properties.test.ts
• tests/unit/api/idempotency-service.properties.test.ts
• tests/unit/api/memory-repository.properties.test.ts
• tests/unit/api/policy-service.properties.test.ts
• tests/unit/api/postage-service.properties.test.ts
• tests/unit/api/receipt-service.properties.test.ts
• tests/unit/api/response.properties.test.ts

Modified:

• package.json (added fast-check devDependency)
• package-lock.json, bun.lockb

Closes #1553