fix: pin vault metadata to IPFS and track pin lifecycle

[bluegate916]

Overview

This PR fixes a gap where backend/src/services/metadata.ts uploaded vault.json to IPFS via ipfs.add without pinning, causing the block to be garbage-collected after ~12h. As a result, GET /vaults/:id/metadata returned 504 gateway errors, frontend vault icons broke after a day, and vault.metadataURI became permanently unresolvable.

The fix pins the CID immediately after upload, persists a pinnedAt timestamp, unpins on vault delete, and adds an admin endpoint to surface stale unpinned CIDs.

Related Issue

Changes

📌 Metadata Pinning

• [MODIFY] backend/src/services/metadata.ts

  • After ipfs.add, call ipfs.pin.add(cid) with the returned CID.
  • Persist pinnedAt on the vault metadata record.
  • Add unpin call on vault delete to release the pin.

• [MODIFY] backend/prisma/schema.prisma

  • Add pinnedAt field to the vault metadata model to record when the CID was pinned.

• [ADD] backend/src/__tests__/metadataPinning.test.ts

  • Mock ipfs.add to return a CID, assert ipfs.pin.add is called with the same CID, and assert the DB row has pinnedAt set.
  • Cover the metadata fetch happy-path to guard against regression.

Verification Results

npm test -- backend/src/__tests__/metadataPinning.test.ts
✅ metadataPinning tests passed

Acceptance Criteria	Status
After ipfs.add, call ipfs.pin.add(cid) and persist pinnedAt timestamp; add unpin on vault delete	✅ Pin added post-upload, pinnedAt persisted, unpin wired to vault delete
Add GET /admin/metadata/pins to list unpinned CIDs older than 24h	✅ Endpoint added to list stale unpinned CIDs
Test: mock ipfs.add to return cid, assert pin.add called with same cid and DB row has pinnedAt	✅ Covered in metadataPinning.test.ts
No regression for metadata fetch happy-path	✅ Happy-path fetch covered in tests

Closes #1449

[drips-wave]

@bluegate916 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits