feat: ZK anonymous reviews, oracle price feed, reentrancy guard, and CQRS (#628, #634, #635, #636)

[Realericky]

Summary

Implements four Stellar Wave features across the frontend, smart contract, and backend layers. Also repairs two corrupted files left by a previous unresolved merge conflict on the branch.

yosemite01#628 – ZK Proofs for Anonymous Job Reviews (Frontend)

• lib/zk-review-proof.ts — WASM-backed proving circuit. Loads the binary lazily, derives a SHA-256 nullifier from credential || subjectId (prevents double-submission), writes the witness into WASM shared memory, and falls back to a deterministic mock proof when the binary is absent (e.g. in CI).
• components/forms/review-form.tsx — review form with a live status indicator (idle → loading_wasm → proving → verified / failed). The submit button is disabled while proving is in progress. Local verifyProofLocally runs before the network call.

yosemite01#634 – Decentralized Oracle for Fiat-Pegged Bounties (Contract)

• backend/contracts/oracle/src/lib.rs — Soroban OracleContract with:
  • update_price: rejects zero/negative prices and flags anomalous prices that deviate >10 % (1 000 bps) from the last accepted observation.
  • get_price: returns the live price if fresh (≤5 min); otherwise falls back to the hardcoded conservative rate ($0.12/XLM).
  • value_in_tokens: atomic USD→token conversion at exact execution time, reports whether the fallback was used.
• Registered in the workspace Cargo.toml.

yosemite01#635 – Cross-Contract Reentrancy Protection (Contract)

• backend/contracts/escrow/src/reentrancy.rs — global reentrancy guard stored in Soroban temporary storage (TTL = 1 ledger, so it cannot be permanently locked). RAII-style ReentrancyGuard panics immediately on reentrant entry. Helper functions require_active_escrow and require_authorized_party centralise the "Checks" phase.
• backend/contracts/escrow/src/lib.rs — release_funds, refund_escrow, and release_milestone rewritten to follow strict Checks-Effects-Interactions: state is committed to storage before any cross-contract token.transfer call. Events are emitted after the transfer.
• Also fixes two corrupted sections left by an earlier unresolved merge: broken use soroban_sdk import block, duplicate function definitions (release, release_funds wrapper, refund_escrow fragment), missing DataKey enum, and stale test helpers that referenced a deleted release() API.

yosemite01#636 – Event Sourcing and CQRS Architecture (Backend)

• backend/services/api/src/cqrs_write.rs — typed Command enum (8 variants) and DomainEvent enum (8 variants) with serde tags. handle_command validates rating range and converts each command to its domain event(s).
• backend/services/api/src/cqrs_read.rs — denormalised ReadStore with BountyView, EscrowView, and CreatorReputationView projections. project_event applies each event incrementally (incremental running average for ratings). Query helpers: open_bounties() (sorted newest-first), creator_reputation().
• backend/services/api/src/event_indexer.rs — extended with idempotent apply_to_read_store (skips already-applied sequence numbers) and append_event for the in-process event log. Exponential back-off retry on RPC failures.
• backend/services/api/src/main.rs — adds mod cqrs_read and mod cqrs_write. Replaces the corrupted file content (a previous AI response pasted as plaintext) with the correct Rust source.

Test plan

• lib/zk-review-proof.ts: generateReviewProof runs in a browser without a WASM binary (mock path) and returns a non-empty proof + 64-char nullifier; verifyProofLocally returns true.
• components/forms/review-form.tsx: Submit button disabled while isProving === true; status banner cycles through the correct labels; form submits only after proof is verified.
• Oracle: update_price rejects a price >10 % above/below last accepted; get_price returns fallback when no price is stored or when the stored price is >300 s old; value_in_tokens reports used_fallback: true on the fallback path.
• Escrow: release_funds panics on reentrancy (guard in temporary storage); state is Released before the token transfer completes; refund_escrow and release_milestone follow the same CEI ordering. Double-release and unauthorised-caller tests still pass.
• CQRS: handle_command(SubmitReview { rating: 0 }) returns Err; project_event applied twice with the same sequence number produces one bounty entry (idempotency test in event_indexer.rs).
• cargo check passes on the backend workspace.
• next build (or tsc --noEmit) passes on the frontend.

🤖 Generated with Claude Code