Title: feat: add contract verification badge for deployed token WASM

[IFEANYIBRIGHT]

Closes #371
Adds a trust signal to token pages so visitors can tell whether a deployed contract runs the audited SoroPad WASM, has been modified, or can't be verified — combined with lock status, this answers the two questions that actually make a token credible: "does it run audited code" and "can the code still change."

Problem

Previously the token dashboard showed admin address and supply but nothing about the deployed code itself. Since upgrade() exists, a token that started as stock SoroPad code may no longer be — and a locked contract isn't necessarily what it appears either. There was no way for a visitor to verify contract integrity from the public page.

Changes

contracts/wasm-manifest.json — checked-in manifest of reference WASM hashes per release version, built in CI
.github/workflows/ci.yml — [describe what changed: manifest generation/validation step on each commit]
frontend/lib/stellar.ts — added VerificationResult and WasmManifest types, fetchWasmManifest(), and [the deployed-contract WASM hash reader — fill in once finalized]
frontend/hooks/useSoroban.ts — [describe the hook changes supporting verification state]
frontend/components/ui/ContractVerificationBadge.tsx — new badge component rendering Verified / Modified / Unknown states
frontend/app/api/wasm-manifest/ — new API route serving the manifest to the frontend
frontend/app/token/[contractId]/PublicTokenPage.tsx — badge added to the token detail page
frontend/app/components/RecentLaunches.tsx — badge added to launch cards
frontend/.env.example — [note any new env vars needed, e.g. manifest path/URL]

Verification states

Verified — deployed hash matches a known reference version; links to the source tag
Modified — hash doesn't match any known version; shown explicitly with a warning
Unknown — hash couldn't be read from the ledger entry

Combined with lock status
The badge is paired with is_locked() so holders see both signals together — audited code + immutability — rather than either alone.

Testing

[What did you test — verified/modified/unknown states against real deployed contracts? Local manifest mismatch simulation?]

[drips-wave]

@IFEANYIBRIGHT Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits