fix(deploy): resolve SEV-1 deploy pipeline failure (f9b966e)

[Cent-Dave]

closes #580

Summary

Resolves the SEV-1 automated rollback incident triggered by the Deploy - Frontend to Vercel and Artifacts workflow failing on commit f9b966e (ref: main).

This PR merges a previously completed but unmerged fix (branch fix/sev1-deploy-887acea, which resolved an earlier instance of this same pipeline failure) and adds one additional fix discovered during this incident's investigation (WASM compilation target standardization).

Background

A prior SEV-1 on this same workflow (incident 887acea) was fully diagnosed and fixed on branch fix/sev1-deploy-887acea, but that branch was never merged into main. Because the underlying breakage was never actually resolved on main, today's incident (f9b966e) is a recurrence of the same failure signature. Full investigation details are in docs/operations/incidents/2026-08-31-887acea-deploy-failure.md.

Root cause

The deploy workflow was failing across three separate jobs:

deploy-frontend — referenced a nonexistent GitHub Action (vercel/action@v5).
contract-build — rust-toolchain.toml pinned Rust 1.89.0, incompatible with soroban-sdk@26.1.1 (requires Rust 1.91.0+); additionally, the wasm32-unknown-unknown compilation target is unsupported by the Soroban runtime on Rust 1.82+ (Soroban requires wasm32v1-none).
generate-sbom — cyclonedx-npm was being run against a Yarn Berry dependency tree it can't parse correctly.

A pre-existing TypeScript/JSX syntax error in src/components/BuyerLibrary.tsx on main also contributed to build failures and is fixed here.

What changed
.github/workflows/deploy.yml — corrected the Vercel action reference to amondnet/vercel-action@v42; switched SBOM generation to the yarn-native @cyclonedx/yarn-plugin-cyclonedx; standardized the contract build target to wasm32v1-none (matching every other workflow in this repo — contracts.yml, contract-gas-benchmarks.yml, security-pentest.yml, soroban-schema-validation.yml — which had already made this switch); added a workflow_dispatch trigger for manual re-runs during incident response.
rust-toolchain.toml — bumped to Rust 1.91.1 for soroban-sdk@26.1.1 compatibility, added the wasm32-unknown-unknown target alongside wasm32v1-none for broader compatibility.
.github/workflows/{ci,frontend,release,soroban-schema-validation}.yml — reverted several unrelated, unnecessary action-version downgrades that had crept in and reapplied only the fixes actually needed.
src/components/BuyerLibrary.tsx — fixed broken JSX/import syntax blocking compilation.
api/health.test.ts (new) — added test coverage for the health check endpoint.
api/sitemap.ts, api/bundles/unlock.test.ts, api/sitemap.test.ts, server/src/models/AuditLog.ts, src/lib/auth/secretsRotation.ts, src/lib/i18n-errors.ts, src/lib/stellar/promptHashClient.ts, src/pages/browse/PromptModal.tsx, src/pages/history/page.tsx, src/providers/WalletProvider.tsx, src/test/render.tsx — minor fixes required to get the full test suite and typecheck passing again (see incident doc for details on each).
docs/operations/incidents/2026-08-31-887acea-deploy-failure.md (new) — full incident postmortem: timeline (sourced from git commit metadata and the GitHub Actions API — no fabricated timestamps), 5-whys root cause analysis, and corrective actions.
Verification
npm run typecheck (tsc -b): passed, 0 errors.
npm run lint (eslint .): passed, 0 errors (191 pre-existing warnings, unrelated to this change).
npx vitest run: full suite passed locally.
cargo test -p prompt-hash / cargo check --lib -p prompt-hash: passed against the updated Rust 1.91.1 toolchain.
cargo build --target wasm32v1-none --release -p prompt-hash --lib: confirmed this is the correct target for the current soroban-sdk version (the deploy workflow's previous target, wasm32-unknown-unknown, fails outright on Rust 1.82+ with a Soroban-specific panic).
Current production status

Not yet recovered. As of this PR, https://prompt-hash-stellar.vercel.app/api/health and /api/status are both returning 500 FUNCTION_INVOCATION_FAILED — production is still serving the broken/rolled-back state from the original incident. This PR does not claim recovery; it makes the fix available for review and merge. Production health checks must be re-verified with an actual 200 response after this is merged and the deploy workflow runs successfully — see the incident doc's outstanding action item.

Notes for reviewers
This branch could not be validated end-to-end via a real GitHub Actions deploy run prior to this PR, because Vercel deployment secrets (VERCEL_TOKEN, VERCEL_ORG_ID, VERCEL_PROJECT_ID) exist only on this upstream repo, not on the fork. All verification above is local (build/test/lint) — merging this PR is what will trigger the real, secret-backed deploy workflow for the first time against this fix.
contracts/Cargo.lock is not part of this diff.

[drips-wave]

@Cent-Dave Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[barry01-hash]

Resolve conflict