[atharrva01]

Summary

Week 4 of issue #66's deliverable 3 (HTLC locks), following the service layer merged in #29. Exposes lock, claim and reclaim over the owner REST API, adds e2e coverage, and documents them.

• POST /owner/accounts/{id}/lock, /claim and /reclaim in swagger.yaml, with routes.gen.go regenerated (oapi-codegen v2.5.1) and the handlers added to owner/routes/routes.go.
• Hashes and pre-images are standard base64 strings and deadline is in seconds from now. Lock returns a node-generated pre-image with its SHA-256 hash, unless the caller supplies a hash, in which case no pre-image is returned.
• All three requests take an optional tmsId (omitted means the node's default TMS), so FabricSmartClient.Lock/Claim/Reclaim now take the TMS as a parameter.
• This app has no request validation middleware, so the handlers return a 400 for locally detectable input errors: a deadline below one second (zero would silently mean the SDK's one hour default), a hash that is not a 32 byte SHA-256 digest (Panurus does not check it, so a wrong-length hash would lock funds until expiry), and an empty pre-image or hash. Everything else keeps the existing convention of returning the error as a 500.
• scripts/test.sh gets run_htlc_test, run after the existing flow: (1) generated pre-image with an explicit tmsId, lock then claim; (2) caller-supplied hash, short deadline, reclaim after expiry, and a late claim that must be rejected. Balances are asserted relative to the start of each scenario and polled, since finality on the non-initiating node is asynchronous.
• cleanup() in test.sh now only tears down the network from the main shell. Command substitutions inherit the ERR trap, so a failure inside one of the new $(...) helpers ran the teardown twice.
• README: a new "Example: HTLC lock, claim and reclaim" section, and the three stale links to hyperledger-labs/fabric-token-sdk now point at LFDT-Panurus/panurus.

Stays on Panurus and Fabric Smart Client v0.18.0. Bumping to v0.22.0 is a separate follow-up.

Notes for review

• The HTLC e2e block runs on fabric3 by default; set HTLC_TEST=1 to run it on other platforms. HTLC has only been verified on fabric3.
• curl_with_retry in test.sh never returns a non-zero status (local exit_code=$? after an if with no true branch is always 0). In the last green main run the fabricx job's POST /endorser/init returned 500 on all 30 attempts and the job still passed, so a green fabricx job says little. I left the helper alone here because fixing it would turn that job red for reasons unrelated to HTLC. Happy to fix it in a follow-up once fabricx is healthy.
• The committed routes.gen.go was already out of date with the spec, so its diff also contains two lines unrelated to HTLC: the generator version header (v2.5.0 to v2.5.1) and one RedeemRequest.Message comment.

Test plan

• go build and go vet clean on both the default and fabricx build tags
• Live on fabric3, by curl: deadline 0 or missing, a wrong-length hash, an empty claim and an empty reclaim all return 400 and leave balances unchanged; lock debits the sender immediately; claim credits the recipient; a second claim of the same pre-image and a wrong tmsId both return 500
• Full clean PLATFORM=fabric3 ./scripts/test.sh passes: the existing issue/transfer/redeem flow, then every HTLC assertion
• With the cleanup() guard a failure inside $(...) tears the network down once; without it, twice
• Not run on fabricx or xdev