feat(auth): add manageData operation and time bounds validation to SEP-10 verification

[oomokaro1]

Closes #4

Summary

Strengthen SEP-10 challenge verification by enforcing time bounds and validating the expected manageData operation is present in the signed transaction.

Changes

• Require time bounds: Reject transactions with no time bounds or infinite time bounds (TimeoutInfinite) — prevents replay attacks
• Validate manageData operation: Ensure the signed transaction contains the expected chainlearn.io manageData operation before accepting it
• Test coverage: Added 2 new unit tests covering both rejection paths (missing time bounds, wrong manageData operation)

Testing

• npm run typecheck — passes
• npm run lint — passes (no new warnings)
• npx vitest run tests/unit/services/sep10-auth.test.ts — 10/10 tests pass
  • Existing tests: challenge creation, expired challenges, source mismatch, invalid signature, valid auth (new + existing user)
  • New tests: missing time bounds rejection, missing manageData operation rejection

Tradeoffs

• Kept the existing StellarSdk.verify() approach for signature verification (ed25519) rather than iterating signatures manually
• Used HOME_DOMAIN constant (chainlearn.io) as the expected manageData operation name, matching createChallenge

Out of scope

• No changes to JWT generation or token handling
• No changes to the challenge creation flow (already correct)
• No changes to auth types or routes

Closes #4

[DeFiVC]

Review: Approve

Solid implementation of SEP-10 time bounds and manageData validation.

What looks good:

• Time bounds enforcement (missing + TimeoutInfinite rejection) prevents replay attacks
• manageData operation validation matches HOME_DOMAIN used in createChallenge
• Two new test cases cover both rejection paths cleanly
• PR description is thorough with clear testing evidence and tradeoff notes
• Clean scope — only the auth service and tests touched

CI green, tests pass, code is correct. Approving.