fix(audit): address 4 second-wave audit issues (#1253, #1269, #1273, #1286)

[samjay8]

Summary

This PR addresses four issues from the second-wave repository audit, all assigned to @samjay8 as part of the Stellar Wave Program's 8th wave. Each solution is well-scoped to its respective issue and CI passes on all individual branches.

Closes #1253 · Closes #1269 · Closes #1273 · Closes #1286

---

Issue #1253 — Frontend bundle-size gate

Labels: enhancement frontend infra Stellar Wave

Problem: The contracts job enforced a hard 200 KB WASM size budget, but there was no equivalent gate for the Next.js frontend bundle — no size-limit, no @next/bundle-analyzer, no reporting of any kind.

Solution: Added frontend/scripts/check-bundle-size.sh — a bash script that calculates the total gzipped size of all .js files in .next/static and fails CI if the total exceeds a configurable budget (default: 600 KB). Wired into .github/workflows/ci.yml as a step after next build.

Files changed:

• .github/workflows/ci.yml — added bundle-size check step
• frontend/scripts/check-bundle-size.sh — new script (33 lines)

---

Issue #1269 — Legacy indexer service removal

Labels: backend refactor Stellar Wave

Problem: SorobanIndexerService (soroban-indexer.service.ts) documented itself as racing with SorobanEventWorker on the same Stream/StreamEvent tables. While it was dead code in production (never imported in index.ts), its file, tests, and architecture doc references remained, creating confusion.

Solution: Deleted the legacy service and its tests entirely. Updated docs/ARCHITECTURE.md to remove the "Three files with overlapping names" section and simplify the indexer ownership table to reflect that only SorobanEventWorker + indexerService.ts (control-plane) remain.

Files changed:

• backend/src/services/soroban-indexer.service.ts — deleted (60 lines)
• backend/tests/soroban-indexer.test.ts — deleted (82 lines)
• docs/ARCHITECTURE.md — updated indexer ownership section

---

Issue #1273 — Wire Zod schema into createStream validation

Labels: backend refactor Stellar Wave

Problem: A Zod validation schema (createStreamSchema in stream.validator.ts) already existed with an MAX_I128 upper-bound check on ratePerSecond, but was never imported anywhere. The createStream controller used weaker manual parsing (parseRequiredBigIntField, StreamValidationError) that omitted this upper-bound check.

Solution: Replaced ~70 lines of manual validation (custom error class, parseRequiredBigIntField helper, individual field checks) with a single createStreamSchema.safeParse(req.body) call. This adds the MAX_I128 check and produces structured Zod error details. Updated test assertions to match the new error: 'Validation error' response format.

Files changed:

• backend/src/controllers/stream.controller.ts — replaced manual validation with Zod schema
• backend/tests/stream.controller.test.ts — updated assertions for new error format

---

Issue #1286 — Stream-details action handler tests

Labels: frontend testing Stellar Wave

Problem: None of the action handlers (handleWithdraw, handleTopUp, handlePause, handleResume, handleCancel) or the live-claimable interval logic in stream-details-content.tsx had test coverage.

Solution: Added 376 lines of comprehensive tests covering:

• handleWithdraw — success toast, error toast, disabled button when claimable is zero
• handleTopUp — success toast, error toast, empty-amount guard
• handlePause — success toast, error toast, correct Soroban call args
• handleResume — success toast, error toast, correct Soroban call args
• handleCancel — modal flow entry, error path
• Live-claimable interval — pulsing dot indicator, paused-state display

Files changed:

• frontend/src/app/streams/[id]/__tests__/stream-details-content.test.tsx — +376 lines of handler tests

---

Verification

✅ CI passes on all 4 individual branches (PR Test Gate, CI, Security Checks — all success)
✅ All changes cherry-pick cleanly onto upstream/main with no conflicts
✅ No unrelated changes included — each fix is precisely scoped to its issue