test+docs: cover missing views/InvalidRate rollback, UI primitives, and api-types drift check (#1539 #1540 #1541 #1542)

[D-Lord-15]

Summary

Resolves four third-wave-audit issues across the Soroban contracts and the frontend. Each is independently testable and the changes are grouped into one commit per issue.

Closes #1542
Closes #1541
Closes #1540
Closes #1539

Changes

Test create_stream InvalidRate rejection fully reverts fee+transfer (#1542)

contracts/stream_contract/src/test.rs

New test_create_stream_invalid_rate_rolls_back_transfer_fee_and_counter:

• Initializes a 1% protocol fee, then calls create_stream with amount = 100, duration = 1000 so the net amount (99) yields a 0/s rate and the call returns Err(InvalidRate).
• Asserts the sender's, treasury's, and contract's token balances are exactly what they were before the failed call — the gross transfer and any computed fee are unwound, and no fee is retained.
• Asserts the stream-id counter was not consumed: a subsequent successful create_stream receives stream_id == 1, and that successful call does charge the fee (proving the fee machinery is exercised).

get_stream/get_fee_config/is_stream_completed on missing state (#1541)

contracts/stream_contract/src/test.rs

• test_get_stream_missing_id_returns_none — never-created ids (0, 1, u64::MAX) return None.
• test_get_fee_config_before_initialize_returns_none — get_fee_config returns None before initialize.
• test_is_stream_completed_missing_id_returns_false — never-created ids return false.

Wire the api-types codegen drift check into CI + document it (#1540)

frontend/src/lib/api-types.ts, CONTRIBUTING.md, .github/pull_request_template.md

The CI drift step (npm run codegen:openapi -> npm run codegen:api-types -> git diff --exit-code) was already present in .github/workflows/ci.yml, but it was undocumented and the api-types.ts header still claimed codegen was manual-only. This change:

• Corrects the api-types.ts header to describe the committed spec, the codegen commands, and the CI enforcement.
• Adds an API Types Drift Check section to CONTRIBUTING.md, local run steps, and a PR checklist.
• Adds the drift check to the PR template checklist.

Verified locally that openapi-typescript against the committed backend/swagger/flowfi.openapi.json reproduces the checked-in api-types.generated.ts byte-for-byte, so the CI diff is currently clean.

Add unit tests for shared Button, Card, and Stepper primitives (#1539)

frontend/src/components/ui/{Button,Card,Stepper}.test.tsx

New test files colocated with each component (matching Skeleton.test.tsx):

• Button — variant/size class application, disabled when disabled or loading is true, and the aria-busy + visually-hidden Loading label while loading.
• Card — glow/hover prop toggles, base styling, children rendering, custom className merge.
• Stepper — aria-current="step" on the active step only, and the correct completed/active/upcoming class and screen-reader suffix per index.

Verification

• Contracts: cargo test -p stream_contract --lib — 253 passed, 1 ignored; cargo fmt --all -- --check and cargo clippy --all-targets -- -D warnings clean.
• Frontend: vitest run — 687 passed (74 files); eslint clean on all new files.

Notes

No production contract logic changed — this PR is test and documentation only.