feat: per-route metrics, audit events, stellar transfer test, and risk gauge

[walexjnr]

Summary

• CT-40 ([CT-40] Add consistent metrics instrumentation across all handlers #945) — record_transfer now increments request_count, and a new per-route counter (requests_total_by_route) distinguishes verify/submit/revoke/transfer volume in /metrics, with tests.
• CT-39 ([CT-39] Wire event.rs into the crate as a real audit module #944) — Wired event.rs into the crate as a real audit module: added AuditError/Result to error.rs, declared pub mod event, emit an Event per verify/submit/revoke/transfer request persisted via the cache backend, and added a GET /audit endpoint to read events back.
• CT-35 ([CT-35] Implement StellarClient::anchor_transfer() — currently a no-op that fabricates anchored records #940) — Added a mocked-Horizon test verifying anchor_transfer actually submits a transaction (account fetch + POST /transactions) instead of trivially returning Ok, plus a failure-path test.
• FE-55 ([FE-55] Build risk score gauge component #926) — Added a reusable RiskGauge component (inline SVG arc, colour-banded green/yellow/red, riskScore + riskFlags props, screen-reader text) with component render tests.

Closes #945
Closes #944
Closes #940
Closes #926

[vercel]

@walexjnr is attempting to deploy a commit to the Mftee's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@walexjnr Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[mftee]

Reviewed. Strong PR:

• Fixes a genuine pre-existing compile bug in stellar.rs::check_connection (referenced an undefined result variable — this wouldn't have compiled). Good catch.
• Rewrites verify_hash tests to match the real Horizon manageData account-lookup implementation instead of a stale /transactions?memo= approach the old tests assumed.
• New per-route request metrics (requests_total_by_route{route=...}, CT-40) wired into verify/submit/revoke/transfer/batch-verify, with isolation tests.
• New audit-event log (CT-39): record_audit_event appends to a capped cache-backed list, GET /audit reads it back reversed (most recent first), failures are logged and never break the request path — good defensive design for an audit trail.
• RiskGauge: clean inline-SVG gauge, clamps out-of-range scores, includes an sr-only text equivalent for accessibility, solid test coverage.

Approving.