feature/c10-nfc-core

[YAustinXYZ]

Closes #32

---

Summary

This PR implements C10 — NFC protocol and session management (CLI-046 through CLI-052), delivering the core NFC transport stack required for receive/send payment flows.

Native setup & configuration (CLI-046)

• Installed react-native-nfc-manager, zod, and zustand
• Added app.config.ts with NFC plugin, iOS NFCReaderUsageDescription, Android NFC permission, and NDEF entitlements
• Documented rebuild requirements in README.md and docs/adr-nfc-library.md

NfcService abstraction (CLI-047)

• Defined stable interface in NfcService.types.ts (isSupported, isEnabled, startReaderSession, startWriterSession, cancelSession)
• Native implementation in NfcService.native.ts (NDEF MIME application/json)
• Web stub in NfcService.web.ts returning unsupported
• createMockNfcService() for unit tests

Payment request schema (CLI-048)

• Zod schema aligned to payment_request.v1: type, recipient, asset, amount, timestamp, expiresAt
• Stellar public key, decimal amount, and asset validation via wallet/constants/assets.ts
• validateExpiry() and parsePaymentRequestFresh() helpers

Payload codec (CLI-049)

• NfcPayloadCodec: compact JSON encode/decode with 880-byte max guard
• Typed errors for malformed JSON, oversize payloads, invalid/expired requests

Writer & reader sessions (CLI-050 / CLI-051)

• Writer (receiver): 60s timeout, auto-cancel, cleanup on unmount/cancel
• Reader (payer): 45s timeout, single-read policy, rejects expired payloads
• React hooks: useNfcWriter, useNfcReader

Session store & auth coordination (CLI-052)

• nfcSessionStore state machine: idle → scanning / writing → success / error
• Single active session enforced via nfcActive
• useSessionPolicy respects nfcActive to avoid auth lock during NFC sessions

Tests & docs

• 15 unit tests: schema parsing, codec roundtrip/oversize/expiry, store transitions
• Manual PoC helpers in nfc-spike.ts for device verification
• Jest + npm run typecheck configured

Test plan

• npm test — 15 tests passing (schema, codec, session store)
• npm run typecheck — no TypeScript errors
• Rebuild dev client: npx expo prebuild --clean && npx expo run:android (or iOS)
• Device smoke: nfcSpikeCheckSupport() returns supported: true
• Two-device manual: writer broadcasts request, reader receives and validates payload
• Verify writer timeout (60s) and reader timeout (45s) cancel cleanly
• Verify expired payload is rejected on reader path

Out of scope (follow-up PRs)

• Receive/send screen orchestration (C11+)
• NfcAvailabilityBanner UI (CLI-053)
• Server-side replay protection API
• QR fallback