[DokaIzk]

contracts/vault — Issue #1680: reject a second large withdrawal while one is pending

withdraw now checks for an existing PendingWithdrawal(user) before creating a
new timelocked request, so a second large withdrawal is rejected
(WithdrawalCooldownActive) instead of silently overwriting the pending entry
and restarting its 24-hour timelock. No event is emitted for a replacement,
because no replacement can occur.

contracts/vault — Issue #1681: add cancel_withdrawal(user)

Adds a user-owned cancel_withdrawal entrypoint that requires the caller's auth
(user.require_auth()), removes the pending entry, and emits a pndwcn event.
Also adds a read-only pending_withdrawal(user) query. Documented in the
withdrawal lifecycle doc and error-code catalog.

backend — Issue #1676: set security headers with helmet

Applies helmet() before routes so every response (including Swagger UI)
receives X-Content-Type-Options, X-Frame-Options, and
Content-Security-Policy. HSTS is production-only. Integration test asserts
the headers on /health and that the CSP still lets /docs load.

backend — Issue #1675: single graceful shutdown path

The GracefulShutdownHandler constructed in index.ts is now the single
shutdown path. Outbox, HTTP server, and DB are registered with onShutdown in
documented order (server drains in-flight requests first, then outbox, then DB).
The duplicate ad hoc process.on('SIGTERM'/'SIGINT') handlers and the
redundant outbox start are removed. Test sends SIGTERM and verifies shutdown
order.

Note: minimal surgical repairs were also made to pre-existing breakage that
kept the contract from compiling (a mangled set_strategy cooldown block, a
duplicated total_assets oracle block, and duplicate imports/dead code in
permissions.rs) so the new code could be compiled and tested.

Closes #1680
Closes #1681
Closes #1676
Closes #1675

[drips-wave]

@DokaIzk Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits