Persist target allocations, verify Stellar submissions, and add user API keys

[OTD-Aregbesola]

Target allocations, oracle verification, and consumer API keys previously relied on placeholder or in-memory behavior. This change makes them persistent and validates submissions against the Stellar ledger.

• Persist complete allocation versions, validate asset membership and 100% totals, replace current targets atomically, and expose recoverable history.
• Store indexed submission history, reject duplicate payloads and transactions atomically, and retain replay records indefinitely.
• Verify successful Soroban submit_price transactions against the configured network and contract, with confirmation checks and bounded retries for transient RPC failures.
• Add hashed user API keys, metadata-only listing, owner-scoped revocation, last-use auditing, caching, and scope enforcement. Revocation also invalidates API-key-issued JWTs. Static keys remain supported with deprecation guidance.

The Stellar payload representation follows the existing six-argument submit_price interface: SHA-256 of its canonical XDR argument vector. Related contract work: TRELLIS-STELLAR/Trellis-contracts#9. Verification requires a Stellar transaction reference; legacy payload signatures alone are not ledger evidence.

Validation: 56 tests passed on the rebased branch, including existing rebalancing behavior. Two additional API key strategy tests passed with the upstream quota dependency isolated using its last valid configuration. All three migrations passed PostgreSQL smoke checks in PGlite, including rollback, restart persistence, unique replay indexes, and revocation.

Existing malformed quota configuration on main blocks the full TypeScript build and the direct API key strategy test suite. That unrelated configuration is unchanged. Scoped ESLint and diff whitespace checks passed; existing formatting in shared app and rebalancing code remains outside scope.

Closes #12
Closes #11
Closes #10
Closes #9

[github-actions]

Code Review & Auto-Merge — @dorismaduegbunam 🚀

Thank you @OTD-Aregbesola for your contribution!

• PR Title: Persist target allocations, verify Stellar submissions, and add user API keys
• Author: @OTD-Aregbesola
• Branch: codex/persist-allocations-oracle-api-keys -> main
• Linked Issues: Closes Rebalancing service: storeTargetAllocations is unimplemented #12, Closes Oracle submission verifier queries a placeholder instead of the database #11, Closes Oracle submission verifier has a placeholder blockchain adapter #10, Closes API key strategy has no database lookup for user-generated keys #9
• Status: Approved & Merged into main.

Verified code changes and repository requirements. Merging pull request.