Summary

Bundles four issues into one PR.

• Add gated resource access checks based on wallet ownership #181 — Wallet-ownership gated resource access. New utils/wallet-ownership.utils.ts exposes a single typed verdict (granted / wallet_not_found / forbidden) for "does this Stellar wallet own this creator profile?". middlewares/wallet-ownership.middleware.ts turns the verdict into HTTP responses with the existing { success: false, error: { code, message } } shape. Wired into PUT /api/v1/creators/:creatorId/profile — previously open, now requires the owning wallet in the x-wallet-address header. 13 new tests cover authorized and unauthorized paths.
• Add service-layer tests for core creator flows #178 — Service-layer tests for creator flows. 13 new tests across creator.service.test.ts (pagination math, sort options, parallel query, edge cases) and creator-profile.service.test.ts (read shape, upsert envelope, schema-boundary contract). Tests mock prisma at the module boundary so they stay isolated from unrelated modules and remain deterministic.
• Add seed and fixture guidance for contributors #179 — Seed/fixture guidance for contributors. Idempotent prisma/seed.ts creates three deterministic users (alice / bob / charlie) with wallets and creator profiles — enough to exercise list / read / ownership-gated update flows. docs/contributor-seed.md documents the fixture catalogue, reset workflow, and the exact requests that exercise each gated path. CONTRIBUTING.md links the new doc.
• Add release checklist documentation for backend deploy safety #180 — Release checklist for backend deploy safety. docs/release-checklist.md with pre-deploy / rollout / post-deploy / rollback sections. Concrete and operational — real commands (pnpm exec prisma migrate diff, GET /api/v1/health/detailed), real endpoint names — so a contributor can use it cold without additional context.

Test plan

• pnpm lint — clean
• pnpm build — clean
• pnpm exec jest — 99 tests pass across 10 suites (was 73 across 6 on main; +26 new tests, no regressions)
• PUT /api/v1/creators/alice/profile with x-wallet-address: GA7XLM…ALICE returns 200 (manual; needs the seed)
• Same request with x-wallet-address: GA7XLM…CHARLIE returns 403 (manual; needs the seed)
• Same request with no header returns 401 (manual)

Pre-existing failures

main already has 8 test suites that error with "Your test suite must contain at least one test" — older bespoke test scripts that ran assertions in plain code without describe/it. This PR does not touch them; the same 8 suites still fail on this branch. Worth a follow-up issue if any of them carry behavior that should be retained.

Fixes

• Fixes: Add service-layer tests for core creator flows #178
• Fixes: Add seed and fixture guidance for contributors #179
• Fixes: Add release checklist documentation for backend deploy safety #180
• Fixes: Add gated resource access checks based on wallet ownership #181