feat: harden runtime and add Soroban funding orchestration

[Chucks1093]

Closes #1
Closes #13
Closes #19
Closes #20

Changes

• aligned the TypeORM models with the initial schema by explicitly mapping the quoted camelCase user columns and documenting the local database workflow
• added a migration that links transactions to both invoices and investments with nullable foreign keys and supporting indexes
• updated payment verification to persist invoice_id alongside investment_id for investment funding transactions
• added Soroban escrow funding orchestration behind a feature flag using a wallet-signing XDR handoff model
• persisted pending investment transactions only after draft preparation, so reconciliation can confirm final on-chain success later
• hardened the HTTP runtime with configurable trust proxy, CORS allowlist, JSON body-size limits, and graceful shutdown request draining
• added security and orchestration documentation for production operations
• added unit tests for runtime hardening and Soroban funding orchestration

Testing

• npm run type-check
• npm run lint
• npm test

Notes

• npm run db:migrate was not executed in this environment because a local PostgreSQL instance and DATABASE_URL were not available
• Soroban funding currently uses the unsigned XDR wallet-signing flow (wallet_xdr) instead of server-side signing

[drips-wave]

@Chucks1093 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits