[fadesany]

Summary

Fixes four third-wave audit issues in one branch.

#1532 — depositedAmount has no i128 cap

createStreamSchema is already wired into POST /v1/streams, but its depositedAmount field only enforced the numeric format, so a decimal string above i128::MAX passed validation and reached BigInt arithmetic / the i128 DB columns. The i128 bound check is now shared between ratePerSecond and depositedAmount in backend/src/validators/stream.validator.ts.

• Regression tests: schema-level (reject > max, accept == max) plus controller-level and route-level POST /v1/streams tests asserting 400.

#1533 — GET /v1/users/:publicKey/events had no auth

The route now uses requireAuth, and getUserEvents rejects (403) when the authenticated caller's public key differs from the :publicKey path param, mirroring GET /v1/events. Missing auth is rejected with 401 (middleware and controller guard).

• Regression tests: unit tests for 401/403, and integration tests asserting an unauthenticated request is rejected and a different-wallet request is rejected.
• OpenAPI spec and generated API types regenerated.

#1534 — SSE clientId uses Math.random()

backend/src/controllers/sse.controller.ts now generates clientId with crypto.randomUUID(), matching every other id generator in the backend. The subscribe test asserts the UUID format and that the connected event carries the same id.

#1547 — Action Signing Model omitted Cancel

Both docs/ARCHITECTURE.md and backend/docs/ARCHITECTURE.md now include a Cancel row and corrected prose.

Note: the issue's premise no longer matches main. backend/src/controllers/stream/cancel.ts does not read KEEPER_SECRET_KEY; it requires senderSecret in the request body and passes it to sorobanService.cancelStream(). A grep of backend/src confirms topUpStream() is the only caller of the keeper secret, so documenting Cancel as custodial would make the docs wrong. Instead the docs now state that cancel is submitted server-side but authorized with the caller's own key, and explicitly list the set of custodial vs. user-authorized actions, with the grep evidence.

Verification

• cd backend && npx tsc --noEmit — clean
• cd backend && npx vitest run --exclude='tests/integration/**' --coverage.enabled=false — 59 files, 727 passed, 3 skipped
• cd backend && npx vitest run --coverage.enabled=false tests/stream.validator.test.ts tests/stream.controller.test.ts tests/user.controller.test.ts tests/sse.controller.test.ts tests/integration/events-list.test.ts tests/integration/sse-subscribe.test.ts tests/stream.test.ts — all passing
• npm run codegen:openapi + npm run codegen:api-types regenerate cleanly (spec/types committed)

Closes #1532
Closes #1533
Closes #1534
Closes #1547