feat: implement milestone management APIs

[playmaker410]

Summary

Implements the four milestone management API endpoints requested in #99.

Endpoints

Method	Path	Description
POST	/api/milestones	Create a milestone (client only)
PATCH	/api/milestones/:id	Update a milestone (client only)
POST	/api/milestones/:id/submit	Submit a milestone for review (freelancer only)
POST	/api/milestones/:id/approve	Approve or reject a submitted milestone (client only)

Implementation Details

• Role-based access: POST/PATCH restricted to the project client; submit restricted to the contract freelancer; approve restricted to the contract client.
• Status guards: PATCH blocked on submitted/approved/paid; submit requires pending or in_progress; approve requires submitted.
• Approve/Reject: The approve endpoint accepts action: 'approve' | 'reject' with rejection_reason required on rejection.
• Consistent error handling: All endpoints return structured { error, code } responses matching the existing project conventions.
• DB schema: Uses the existing milestones table (UUID PK, milestone_status enum, contracts FK for role resolution).

Testing

Follows the same patterns as existing routes (/api/projects, /api/disputes). Local build/lint not runnable without DATABASE_URL, consistent with CI setup described in README.

Closes #99

[drips-wave]

@playmaker410 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits