fix(web): remove fake vouch XDR, externalize config, drop node-crypto fallback, split bundle

[EmeditWeb]

Summary

Resolves four code-lapse issues found during the CI/quality pass on StepFi-Web. Each was code that either lied about what it did, hardcoded environment-specific values, or degraded the build — exactly the kind of lapse the quality pass exists to catch.

Changes

1. Removed vouch signing theater (correctness + trust)

Vouch.tsx and MentorDashboard.tsx built a random, fabricated XDR string, asked Freighter to sign it, then discarded the signature. It accomplished nothing functional and trained mentors to blind-sign arbitrary payloads — a real trust hazard.

Vouch approval is an authenticated, off-chain backend operation: POST /vouching/approve transitions the vouch record PENDING → APPROVED, authorized by the mentor's wallet-bound JWT (established once at wallet-connect time). There is no transaction to sign, so the signing step is removed and the handlers call the mutation directly. Dead txHash plumbing is dropped from useOptimisticVouch and vouching.service.

If on-chain vouching is wired up later, it should route through useTransaction + a backend-built XDR the way the deposit flow (#91) does — never a client-fabricated one.

2. Externalized hardcoded config

API_BASE_URL, STELLAR_NETWORK and the five CONTRACT_IDS were hardcoded. They now read from VITE_* env vars with testnet defaults — matching the existing SOROBAN_RPC_URL pattern that .env.example already advertised but the code ignored. .env.example now documents every variable.

3. Dropped browser-incompatible crypto fallback

soroban.service computeSha256 had an await import('crypto') Node fallback that triggered Vite's "'crypto' externalized for browser compatibility" warning and emitted a __vite-browser-external chunk. Web Crypto (crypto.subtle) is the single portable SHA-256 path across secure browser contexts and Node 19+, so it is now the only path.

4. Split the monolithic bundle

The router now lazy-loads every route page, so the Stellar SDK and other heavy per-page dependencies leave the initial chunk.

	Before	After
Initial entry	~2,008 kB (565 kB gzip)	386 kB (124 kB gzip)
stellar-sdk	in the initial chunk	isolated in a lazy chunk, loaded only where needed

The residual >500 kB warning on the isolated stellar-sdk chunk is left as-is on purpose — it is an honest signal about a genuinely large dependency, not something to silence with chunkSizeWarningLimit.

Test plan

• npm run lint — clean
• npm run test — 49/49 pass (10 files)
• npm run build — green; crypto externalization warning gone; initial entry 386 kB
• Reviewer: connect as a mentor and confirm approving a vouch request still transitions it (no Freighter signing prompt should appear)

Follow-up (not in this PR)

handleDecline in the vouch views is still a stubbed 600 ms timeout with no backend decline endpoint to call. Left as-is here — it needs an API endpoint before it can be wired up. Flagging for a future issue.