feat: security hardening — encryption at rest, admin audit log, webhook signatures, secrets scanning

[ambermartin681]

Summary

• Encrypt sensitive fields in the database at rest #731 — Encrypt sensitive fields at rest: Added backend/src/db/encryption.js with AES-256-GCM encrypt/decrypt (12-byte random IV, auth tag). Server now fails fast at startup if DATABASE_ENCRYPTION_KEY is missing or not 32 bytes.
• Add audit log for admin actions #732 — Admin audit log: Added AdminAuditLog Prisma model. Created backend/src/db/adminAuditLog.js utility (logAdminAction). All KYC approve/reject admin actions now write audit entries. Added paginated GET /admin/audit-log endpoint with filters for date range, admin user, and action type. No code ever issues UPDATE/DELETE against this table.
• Validate webhook signatures before processing #733 — Validate webhook signatures: Created backend/src/webhooks/verifySignature.js with HMAC-SHA256 verification using crypto.timingSafeEqual (prevents timing attacks). Fixed existing verifyWebhookSignature in store.js to also use timingSafeEqual. Added POST /api/v1/webhooks/incoming endpoint with signature middleware applied. Secret sourced from WEBHOOK_SIGNING_SECRET env variable.
• Implement secrets scanning in CI #734 — Secrets scanning in CI: Added .gitleaks.toml with custom Stellar secret key pattern (56-char keys starting with S), .gitleaksignore for test fixture suppression, and wired GITLEAKS_CONFIG into the existing security-pipeline.yml gitleaks step.

Test plan

• Verify DATABASE_ENCRYPTION_KEY startup validation: unset the env var, confirm server exits with a clear error message
• Confirm encrypt() → decrypt() round-trips correctly in a Node.js REPL
• Approve/reject a KYC record via admin API, confirm row appears in AdminAuditLog table
• Query GET /admin/audit-log with date/actionType filters
• POST to /api/v1/webhooks/incoming with correct HMAC-SHA256 signature → 200; with wrong signature → 401; with no signature header → 401
• Run gitleaks detect --source . --config .gitleaks.toml --verbose locally, confirm Stellar key pattern fires and test fixtures are suppressed

Closes #731
Closes #732
Closes #733
Closes #734

[drips-wave]

@ambermartin681 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits