feat: add issue templates + implement SEP-10 challenge-response auth

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,102 @@
+---
+name: "Bug Report"
+about: "Report a bug in the OrbitStream Backend API"
+title: "[BUG] "
+labels: ["bug", "needs-triage"]
+assignees: ""
+---
+
+# Bug Report
+
+## 🔍 Is this a regression?
+
+<!-- Did this work before and now it's broken? If so, which version last worked? -->
+
+## 📝 Description
+
+<!-- A clear and concise description of what the bug is. -->
+
+## 🔄 Steps to Reproduce
+
+1. 
+2. 
+3. 
+
+## ✅ Expected Behavior
+
+<!-- What you expected to happen. -->
+
+## ❌ Actual Behavior
+
+<!-- What actually happened. Include error messages, stack traces, or screenshots. -->
+
+## 🌍 Environment
+
+- **OS**: [e.g., Ubuntu 22.04, macOS 14]
+- **Node.js version**: [e.g., 20.11.0]
+- **npm version**: [e.g., 10.2.4]
+- **OrbitStream Backend version**: [e.g., commit hash or version tag]
+- **Database**: [e.g., PostgreSQL 16]
+- **Redis version**: [e.g., 7.2]
+- **Stellar network**: [testnet / mainnet]
+
+## 📋 Configuration
+
+<!-- Paste relevant env vars (REDACT secrets like JWT_SECRET, DATABASE_URL passwords). -->
+
+```env
+NODE_ENV=
+STELLAR_NETWORK=
+PORT=
+```
+
+## 📦 API Request/Response
+
+<!-- If applicable, paste the curl command or SDK call that triggers the bug. -->
+
+**Request:**
+```bash
+curl -X POST http://localhost:3001/v1/checkout/sessions \
+  -H "Authorization: Bearer sk_test_..." \
+  -H "Content-Type: application/json" \
+  -d '{ "amount": 25.00, "asset": "USDC" }'
+```
+
+**Response:**
+```json
+{
+  "statusCode": 500,
+  "message": "Internal server error"
+}
+```
+
+## 📋 Database State
+
+<!-- If the bug involves data, describe the relevant DB state (without secrets). -->
+
+## 🔍 Logs
+
+<!-- Paste relevant backend logs. Redact sensitive information. -->
+
+```
+[Paste logs here]
+```
+
+## 🧪 Test Case
+
+<!-- If possible, provide a minimal test case that reproduces the issue. -->
+
+```typescript
+// Minimal reproduction
+```
+
+## 📎 Additional Context
+
+<!-- Any other context about the problem. Links to related issues, PRs, or docs. -->
+
+## ✅ Checklist
+
+- [ ] I have searched existing issues and this is not a duplicate
+- [ ] I am using the latest version of OrbitStream Backend
+- [ ] I have included all relevant environment details
+- [ ] I have redacted secrets and sensitive information

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Documentation
+    url: https://github.com/your-org/OrbitStream/blob/main/orbitstream_docs/README.md
+    about: Read the OrbitStream documentation before opening an issue
+  - name: Security Vulnerability
+    url: https://github.com/your-org/OrbitStream/security/advisories/new
+    about: Report security vulnerabilities privately

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,75 @@
+---
+name: "Feature Request"
+about: "Suggest a new feature or enhancement for the OrbitStream Backend"
+title: "[FEAT] "
+labels: ["enhancement", "needs-triage"]
+assignees: ""
+---
+
+# Feature Request
+
+## 📝 Summary
+
+<!-- A clear, one-sentence summary of the feature you want. -->
+
+## 🎯 Problem Statement
+
+<!-- What problem does this feature solve? Why is it needed? -->
+
+## 💡 Proposed Solution
+
+<!-- Describe your ideal solution. Be as specific as possible. -->
+
+## 🔄 Alternatives Considered
+
+<!-- Have you considered other approaches? Why is your preferred solution better? -->
+
+## 📋 Acceptance Criteria
+
+<!-- How will we know this feature is complete? List specific, testable criteria. -->
+
+- [ ] Criterion 1
+- [ ] Criterion 2
+- [ ] Criterion 3
+
+## 🏗️ Implementation Notes
+
+<!-- Any technical details, API design ideas, or architecture considerations. -->
+
+### API Design (if applicable)
+
+```typescript
+// Example API endpoint or SDK method
+```
+
+### Database Changes (if applicable)
+
+```sql
+-- Example schema migration
+```
+
+### Affected Modules
+
+- [ ] Auth
+- [ ] Merchants
+- [ ] Checkout
+- [ ] Payments
+- [ ] Stellar
+- [ ] Webhooks
+- [ ] Monitoring
+- [ ] Database Schema
+- [ ] Other: ___
+
+## 📎 Related Issues/PRs
+
+<!-- Link any related issues, PRs, or discussions. -->
+
+## 📋 Additional Context
+
+<!-- Any other context, mockups, or references. -->
+
+## ✅ Checklist
+
+- [ ] I have searched existing issues and this is not a duplicate
+- [ ] I have clearly described the problem this feature solves
+- [ ] I have provided acceptance criteria

src/auth/auth.dto.ts

@@ -1,6 +1,38 @@
-import { IsString, IsNotEmpty } from 'class-validator';
+import { IsString, IsNotEmpty, Matches, ValidateNested } from 'class-validator';
+import { Type } from 'class-transformer';
+
+export class RequestChallengeDto {
+  @IsString()
+  @IsNotEmpty()
+  @Matches(/^G[A-Z0-9]{55}$/, { message: 'Must be a valid Stellar public key (starts with G, 56 chars)' })
+  walletAddress: string;
+}
+
+export class VerifyChallengeDto {
+  @IsString()
+  @IsNotEmpty()
+  @Matches(/^G[A-Z0-9]{55}$/, { message: 'Must be a valid Stellar public key (starts with G, 56 chars)' })
+  walletAddress: string;
+
+  @ValidateNested()
+  @Type(() => SignedTransactionDto)
+  @IsNotEmpty()
+  transaction: SignedTransactionDto;
+}
+
+export class SignedTransactionDto {
+  @IsString()
+  @IsNotEmpty()
+  tx: string;
+
+  @IsString()
+  @IsNotEmpty()
+  passphrase: string;
+}
 
 export class WalletLoginDto {
-  @IsString() @IsNotEmpty() walletAddress: string;
-  @IsString() signature?: string;
+  @IsString()
+  @IsNotEmpty()
+  @Matches(/^G[A-Z0-9]{55}$/, { message: 'Must be a valid Stellar public key (starts with G, 56 chars)' })
+  walletAddress: string;
 }