feat(auth): secure profile and carrier certification validation

[authenticeasy-sys]

Summary

• validate Stellar wallet addresses before they reach escrow funding flows
• align administrative user creation with the registration password policy
• bind carrier certifications to verified, platform-owned uploaded documents
• reject already-expired certifications and automatically revoke verification at expiry

Changes

• add Stellar Ed25519 public-key validation to profile updates
• apply the shared strong-password validator to CreateUserDto
• add a dedicated certification upload flow with MIME/signature verification, safe storage, ownership/provenance checks, and auditable document metadata
• add atomic certification verification, expiry scheduling, referential protection, migration support, and regression tests

Testing

• 9 focused Jest suites passed (114 tests)
• targeted ESLint and TypeScript checks passed
• npm ci --dry-run --ignore-scripts --no-audit --no-fund
• git diff --check
• full build remains blocked by unrelated malformed batchCreate code already present on upstream/main (assigned separately in [BE-154] shipments.controller.ts / shipments.service.ts: batchCreate() contains duplicated, non-compiling code #1542)

Closes #1547
Closes #1548
Closes #1549
Closes #1550

[vercel]

@authenticeasy-sys is attempting to deploy a commit to the Mftee's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@authenticeasy-sys Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits