ci,test: pin Soroban toolchain, add clippy/audit jobs, and LLM transfer tests

[iduhtheman]

Summary

CI hardening for the contracts workspace and unit tests for the AI agent's LLM-path transfer analysis.

Changes

#138 — Pin Soroban toolchain

• contracts/rust-toolchain.toml: declares channel = "stable", targets = ["wasm32-unknown-unknown"], components = ["clippy", "rustfmt"] — all CI jobs now use a single pinned version; upgrading Rust requires an explicit PR

#137 — cargo clippy lint job (wasm32)

• .github/workflows/contracts-ci.yml: new parallel clippy job running cargo clippy --workspace --target wasm32-unknown-unknown -- -D warnings; runs on every PR touching contracts/**

#139 — cargo audit security scan

• .github/workflows/contracts-ci.yml: new audit job via rustsec/audit-check@v2; added schedule: cron: '0 8 * * 1' (Monday 08:00 UTC) so new CVEs surface without code changes

#146 — Unit tests for POST /transfers/analyse (LLM path)

• apps/ai_agent/tests/test_transfers.py: 5 tests covering flagged transfer, clean transfer, missing confidence defaults to 0.0, missing flagged defaults to False, missing OPENAI_API_KEY returns 500

closes #138
closes #137
closes #139
closes #146

[drips-wave]

@iduhtheman Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[codebestia]

LGTM!
Thank you for your contribution.