Fix/issue 284 299

[CHEF-SAVY]

Summary

This PR closes the validation gaps called out in issues #284, #287, #297, and #299 with minimal, focused changes:

• reject same-asset / self-swap intent creation on Stellar when srcTokenAddress === dstTokenContract
• add a contract-style test harness to ensure all build*Message helpers remain canonical and verifiable
• tighten startup env validation for ONCHAIN_INTENTS_ENABLED, WS_MAX_CONNECTIONS, and SOROBAN_FEE_PERCENTILE
• apply @MaxLength() hardening to signature and other free-form DTO fields with Swagger metadata updates

Changes

1) Same-asset intent guard

• added a DTO-level validator to reject srcChain === "stellar" plus identical source/destination contract values
• allows valid cross-chain same-symbol cases to remain accepted
• added a focused validation test for the rejected self-swap case

2) Canonical signed-message contract harness

• added a single contract test that iterates through all exported build*Message helpers
• asserts deterministic output, colon-delimited canonical format, and round-trip verify behavior with a real generated Stellar keypair

3) Env validation coverage

• added Joi validation for:
  • ONCHAIN_INTENTS_ENABLED as a boolean
  • WS_MAX_CONNECTIONS as a non-negative integer
  • SOROBAN_FEE_PERCENTILE against the real FeePercentile union
• included targeted tests for valid and invalid values to fail fast during startup

4) DTO length hardening

• added @MaxLength() constraints to signature fields and other bounded string inputs
• kept the limit aligned to the real 64-byte Ed25519 signature length (88 chars base64, with padding accounted for)
• updated Swagger maxLength metadata and documented the DTO rule in CONTRIBUTING.md

Validation

Ran the focused unit coverage for the changed behavior:

• npm test -- --runInBand --runTestsByPath src/config/env.validation.spec.ts src/common/stellar-signature.contract.spec.ts src/intents/dto/create-intent.dto.spec.ts src/intents/dto/signature-length.spec.ts

This is a minimal fixset aimed at the requested issues only; broader unrelated repo issues were left alone as requested.

Closes #284
Closes #287
Closes #297
Closes #299

[drips-wave]

@CHEF-SAVY Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits