fix: enforce payout lifecycle authorization

[Timrossid]

Summary

Adds payout lifecycle controls to BackendAcademy contracts.

Issue

Closes #667
Closes #584
Closes #586
Closes #576
Closes #587
Closes #688

Changes

• Added a contracts module with payout creation and release operations.
• Restricted payout actions to ADMIN and TREASURY actors.
• Added positive amount and sufficient balance validation.
• Added duplicate payout protection.
• Prevented completed and failed payouts from being released again.
• Added explicit payout failure handling.
• Added audit records for successful, denied, and rejected actions.
• Added focused service tests covering the security requirements.
• Registered the contracts module in the application module.

Validation

• npm test -- --runInBand
• git diff --check

Result: 41 tests passed.

Notes

The Nest build is blocked by the repository environment because external-editor/main/index.js is missing.

Direct TypeScript checking is blocked by existing missing dependencies in unrelated modules, including @nestjs/jwt, @nestjs/config, @nestjs/typeorm, and joi.

The current BackendAcademy application does not yet expose authentication middleware or persistent payout storage. Actor identity is currently passed through request headers at the controller boundary and should be replaced with trusted authenticated request context when the auth layer is completed.

[drips-wave]

@Timrossid Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[MaryammAli]

LGTM