fix: resolve security and correctness issues (#1099 #1100 #1101 #1102)

[leojay-net]

Summary

This PR addresses four issues filed against the backend:

#1102 — Remove duplicate mark-defaulted route registration

loanRoutes.ts registered POST /:loanId/mark-defaulted twice inside the same NODE_ENV guard (lines 62–69 and 72–79). Express only dispatches to the first matching handler, so the second block was unreachable dead code and a maintenance hazard.

Change: Removed the duplicate registration block.

---

#1101 — Add missing requireScopes('read:score') to /:userId/breakdown

Every sibling score route (GET /:userId, /:walletAddress/history, /:walletAddress/nft) enforces requireScopes('read:score') between requireJwtAuth and the param check. The breakdown route was missing it, allowing any JWT—regardless of scopes—to read score breakdown data.

Changes:

• Added requireScopes('read:score') to the GET /:userId/breakdown route in scoreRoutes.ts
• Added a test in scoreBreakdown.test.ts asserting that a token lacking read:score receives 403

---

#1100 — Replace !== with crypto.timingSafeEqual in requireApiKey

auth.ts compared API key secrets with k.secret !== keyStr inside Array.find. String inequality short-circuits on the first differing byte, leaking per-character timing information that can be exploited to recover INTERNAL_API_KEY over many requests.

Changes:

• Added import crypto from "node:crypto"
• Replaced the secret equality check with crypto.timingSafeEqual on fixed-length Buffer instances (length checked first; keys of different lengths are rejected immediately without calling timingSafeEqual)
• Added a unit test in apiKeyScopes.test.ts verifying a wrong key of identical length is rejected

---

#1099 — Fix ensure-core-tables migration colliding with the loan_events view

Migration 1788000000018_unified-contract-events.js renames the loan_events table to contract_events and creates a view named loan_events. The subsequent migration 1789000000000_ensure-core-tables.js guarded its CREATE TABLE loan_events with IF NOT EXISTS (SELECT FROM pg_tables WHERE tablename='loan_events'). pg_tables only enumerates ordinary tables (relkind r/p) and excludes views, so the guard evaluated TRUE and attempted to create the table, failing with relation loan_events already exists on any clean sequential migration run.

Changes:

• Replaced the pg_tables guard with to_regclass('public.loan_events') IS NULL, which resolves any relation type including views
• Added an explanatory comment cross-referencing the earlier migration
• Added a migration-check job in .github/workflows/ci.yml that spins up a fresh Postgres 16 service and runs npm run migrate:up against it end-to-end

---

Test plan

• backend CI job: lint, build, typecheck, and existing test suite pass
• migration-check CI job: all migrations apply cleanly against a fresh empty database
• New test: GET /api/score/:userId/breakdown with a scopeless token → 403
• New test: requireApiKey with a wrong key of the same byte-length as the configured key → throws (rejected)

Closes #1099
Closes #1100
Closes #1101
Closes #1102