feat: add contract bindings and session safety

[Obiajulu-gif]

Summary

• add a Soroban contract binding generator that scans contract crates and writes a typed manifest for frontend/backend consumers
• add a reentrancy mutex around Aegis Vault token-moving write paths and cover the lock/error cleanup behavior
• move passkey sessions into a revocable session store with Redis support, sliding renewal, refresh, and logout endpoints

Closes #520
Closes #521
Closes #522

Validation

• node --test server/tests/passkey-session.node-test.mjs
• node --input-type=module -e "import assert from 'node:assert/strict'; import { buildBindingManifest, renderBindings } from './scripts/generate-soroban-bindings.js'; const manifest = buildBindingManifest(); const aegis = manifest.find((item) => item.crateName === 'aegis_vault'); assert.ok(aegis); assert.ok(aegis.functions.some((fn) => fn.name === 'fund_zone')); assert.ok(renderBindings(manifest).includes('sorobanBindings')); console.log('binding generator smoke ok', manifest.length);"
• git diff --check

Blocked checks

• npm test -- test/soroban-bindings.test.js is blocked because the existing root package.json is invalid JSON near line 2501.
• cargo test --manifest-path contracts/aegis_vault/Cargo.toml is blocked by the existing duplicate [workspace] key in the root Cargo.toml.

[drips-wave]

@Obiajulu-gif Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits