feat: wire withdraw endpoint to soroban contract and refactor routing

[sweetesty]

📌 Pull Request

🔗 Related Issue
Closes #412

📝 Description

• Adds POST /api/v1/streams/:streamId/withdraw endpoint and wires it to sorobanService.withdraw() so frontend and external integrators can trigger withdrawals through the API
• Necessary because the smart contract exposed a withdraw function with no corresponding HTTP endpoint, leaving callers with no way to trigger withdrawals via the API

🚀 Changes Made

• Route — app/api/routes/v1/streams/withdraw.ts:

  • Created POST /api/v1/streams/:streamId/withdraw route handler
  • Validates JWT/SIWX session and confirms caller is the stream recipient
  • Calls sorobanService.withdraw(streamId, callerAddress) and returns txHash in response body
  • Returns 404 if stream not found
  • Returns 403 if caller is not the recipient
  • Returns 400 on contract revert with error message

• Service — app/services/soroban.service.ts:

  • Exposed withdraw(streamId, callerAddress) method wired to the Soroban contract

• Router — app/api/routes/v1/streams/index.ts:

  • Registered the new withdraw route in the v1 router

• Testing — tests/integration/streams/withdraw.test.ts:

  • Created integration test file covering the withdraw endpoint
  • Tests cover success case, 404 (stream not found), 403 (wrong caller), and 400 (contract revert)

Validation

• npm run lint — passed
• Manual verification completed
• All integration tests passing

Screenshots (if UI changes)
N/A

Checklist

• Scope is focused and avoids unrelated changes
• Commit messages are clear and descriptive
• Documentation updated when needed
• ETA was provided when requesting assignment for the linked issue

[ogazboiz]

hey, main was failing CI from broken auth imports + frontend parse errors. fixed and pushed to main now. please rebase to pick up the fixes:

git fetch upstream
git rebase upstream/main
git push --force-with-lease

if there's a conflict, resolve it locally and we'll review once CI is green.