fix(backend,contract): listCreators chain merge, JwtAuthGuard test wiring, cargo audit exceptions, treasury SorobanError scope

[success-OG]

closes #583
closes #584
closes #599
closes #610

PR description:

fix: resolve merge conflict remnants, add listCreators with chain merge, wire JwtAuthGuard in tests, document cargo audit exceptions, and fix SorobanError scope in treasury tests

• Task 1 (CreatorsService listCreators / chain merge): Removed stray git merge branch names (treasury-deposit-event, main) left in subscriptions.service.ts that were breaking TypeScript compilation. Added listCreators(mergeChain?) to CreatorsService — when mergeChain=true it reads each plan from the Soroban contract via SubscriptionChainReaderService, compares against the in-memory planMap, and annotates each plan with syncStatus: 'synced' | 'stale' | 'unknown'. Chain reads are best-effort; disconnected/invalid states fall back to unknown. Wired SubscriptionChainReaderService as an optional dependency. Added GET /creators/list?chain=true endpoint. Added unit tests covering all branches.

• Task 2 (JwtAuthGuard in creators.controller.ts): Imports were already correct. Fixed the controller spec which was failing because JwtAuthGuard ran during tests — added .overrideGuard(JwtAuthGuard).useValue({ canActivate: () => true }) to the test module. Added listCreators mock and tests to the controller spec.

• Task 3 (cargo audit exceptions): Documented RUSTSEC-2024-0436 (paste — unmaintained, compile-time only, transitive via soroban-sdk) and RUSTSEC-2026-0012 (keccak — unsound ARMv8 assembly, not reachable from wasm32 target) in audit.toml with full justification. cargo audit now exits 0 in CI.

• Task 4 (SorobanError scope in treasury tests): Replaced Error as SorobanError import alias with direct soroban_sdk::Error::from_contract_error(...) calls throughout treasury/src/test.rs, eliminating the naming ambiguity with the local Error enum brought in by use super::*. All 11 treasury tests pass.

[drips-wave]

@success-OG Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits