fix(users): prevent IDOR on stellar payout address updates (#39)

[Proxima84-code]

Summary

Fixes an IDOR vulnerability in UsersController.setStellarAddress where any authenticated caller could overwrite another user's Stellar payout wallet address.

Root Cause

While PATCH /users/:id/stellar-address was protected by JwtAuthGuard, the handler trusted the :id URL parameter unconditionally and never cross-checked it against req.user.userId. Because BountiesService.markMergedAndRelease resolves recipient addresses dynamically upon PR merge, an attacker could hijack rewards belonging to other contributors.

Changes

• Injected @Req() req: Request into setStellarAddress.
• Enforced caller ownership check: throws ForbiddenException if callerId !== id.
• Added unit test suite in src/users/users.controller.spec.ts asserting self-updates succeed while cross-user requests and missing session contexts are rejected with HTTP 403.

Closes #39

[vercel]

@Proxima84-code is attempting to deploy a commit to the chonilius' projects Team on Vercel.

A member of the Team first needs to authorize it.