[Backend] Stellar signature auth to protect private API routes #15

Problem

Backend routes are publicly accessible — any caller can read/write messages for any Stellar address.

Solution

Stellar challenge-response authentication:

1. `GET /auth/challenge?address=G...` — return signed nonce + expiry
2. Client signs with Stellar wallet (Freighter / WalletsKit)
3. `POST /auth/verify` — backend verifies signature, returns JWT
4. Protected routes require `Authorization: Bearer `

Protected routes

• `POST /messages` — only sender
• `GET /inbox/:address` — only that address
• `GET /notifications/:address` — only that address

Acceptance criteria

• Unauthenticated requests → `401`
• JWT expires after 1 hour
• Frontend silently refreshes on expiry
• Tests for challenge, verification, and expired JWT