feat: maskWebhookUrl helper, webhook payload builder, structured logs, and wallet holdings endpoint

[chinelo002]

Summary

This PR adds four features: a URL masking utility for webhook callback URLs, a buildWebhookPayload helper for serialising trade events, structured info logs on webhook registration/deletion, and a new GET /wallets/:address/holdings endpoint with an integration test for the empty-wallet case.

closes #442
closes #444
closes #449
closes #450

Changes

• Add helper for masking webhook callback URLs in logs and error responses #444 — maskWebhookUrl helper: Added src/utils/webhook-mask.utils.ts with maskWebhookUrl(url): string — returns scheme://host only using new URL(url).origin, stripping path, query string, and fragment. Returns '[invalid url]' on parse failure. 7 unit tests cover: query string stripped, path stripped, no-path URL, invalid input, empty string, non-standard port preserved, fragment stripped.

• Add helper for building the trade webhook POST payload from an indexed trade event #450 — buildWebhookPayload helper: Added src/modules/webhooks/webhook-payload.utils.ts with buildWebhookPayload(TradeEvent): WebhookEventPayload that maps camelCase event fields to the snake_case payload contract. Updated webhook.service.ts to replace the inline payload object literal in dispatchWebhookEvent with this helper. 3 unit tests confirm buy/sell event mapping and exact output key set.

• Add structured log for creator trade webhook registration with creator ID and event types #449 — Structured webhook registration/deletion logs: Edited webhook.service.ts to emit logger.info({ creator_id, webhook_id, event_types, registered_at }, 'Webhook registered') after a successful createWebhook and logger.info({ creator_id, webhook_id, deleted_at }, 'Webhook deleted') after deleteWebhook. The callback URL does not appear in any log line.

• Add integration test for wallet holdings endpoint returning empty array for wallet with no keys #442 — Wallet holdings endpoint + empty-wallet integration test: Added wallet-holdings.service.ts (calls fetchOwnership and maps to HoldingItem[]), wallet-holdings.controllers.ts (validates address, calls service, returns 200), and registered GET /:address/holdings in wallets.routes.ts. Integration test (wallet-holdings.integration.test.ts) covers: valid address with no holdings → 200 + holdings: [] + total_portfolio_value: '0'; valid address with holdings → 200 + populated data; malformed address → 400 + VALIDATION_ERROR; service error forwarded to next().

Test plan

• pnpm test or jest for all new test files.
• All unit tests added alongside each utility.
• Integration tests mock the service layer (no database required).

[drips-wave]

@chinelo002 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits