Fix/db loan events indexes

[mijinummi]

📝 Description

Overview

This PR adds missing indexes to the loan_events table to improve query performance.

Key Features

• Index on borrower for history queries
• Index on event_type for filtering
• Composite index on (loan_id, event_type) for loan detail queries
• Index on created_at for date range filters
• Migration file created under backend/src/db/migrations

---

Closes #438

[ogazboiz]

The contracts CI is failing on the rustfmt format check. This isn't a logic issue, just formatting.

Run this in the contracts directory and push:

cd contracts
cargo fmt

Then commit and push the formatting changes. The CI should pass after that.

[ogazboiz]

Backend CI is failing with a Jest environment error:

ReferenceError: You are trying to `import` a file after the Jest environment has been torn down.

This usually means a test file has async operations that outlive the test suite — either missing await on async teardown, or an import that fires a side effect (like a Redis/DB connection) after the test runner has already cleaned up.

To fix: check if any test files in your PR have async operations in top-level scope without proper beforeAll/afterAll cleanup. Also make sure any mocks for Redis or DB are set up before the app module is imported.

Contracts CI is also failing on cargo fmt. Run cargo fmt in the contracts/ directory and push the formatting changes.

[ogazboiz]

Two failures to fix:

Contracts CI: Failing under 30s, which is a cargo fmt issue.

cd contracts
cargo fmt

Backend CI: eventIndexer.test.ts failure. Rebase on main to pick up the recent test fix:

git fetch upstream
git rebase upstream/main

Commit, format, and push when done.

[ogazboiz]

The codebase issues on main have been resolved and all CI checks are passing now. Please rebase your branch to pull in the latest changes before continuing. Thanks for your patience.

[ogazboiz]

No merge conflicts but same issues as #517: date-based migration naming instead of numeric convention, untyped event handlers, missing .js extensions. This PR's diff is nearly identical to #520. These should be coordinated so only one lands. Fix migration naming.

[ogazboiz]

heads up, a few important changes just landed on main that affect your PR:

1. axios pinned to 1.13.5 - there's an active supply chain attack on axios 1.14.1 (pulls in confirmed malware). we added overrides in all package.json files to block it.

2. CI now runs a supply chain audit before backend/frontend jobs. if your lockfile has a compromised package, CI will fail with a clear error.

3. backend test fixes - loanEndpoints tests now use valid Stellar addresses and base64 strings. if your PR was failing backend CI but you didn't touch backend code, this should fix it after rebase.

please rebase on latest main:

git fetch upstream
git rebase upstream/main
git push --force-with-lease