docs: fix CODEOWNERS onchain paths and document full check suite in CONTRIBUTING.md

[DanielCharis1]

Summary

Resolves the two documentation issues assigned to @DanielCharis1. The two backend code issues (#534, #527) require schema/CSP design changes and are not included here — see "Remaining issues" below.

Changes

#520 — CODEOWNERS lists onchain paths that do not exist and calls the Rust contracts Cairo

• Replaced the nonexistent /onchain/src/ and /onchain/tests/ paths with the real contract crates: /onchain/contracts/, stellar_hunts, stellar_hunts_nft, stellar_hunts_receiver, stellar_hunts_types.
• Corrected the section comment from "Onchain (Cairo smart contracts)" to "Onchain (Rust / Soroban smart contracts)".
• Removed the leftover template placeholder text ("Replace the placeholder handles below...").
• Verified every path in the file exists in the repository (while read -r p _; do [ -e "${p#/}" ] || echo "missing: $p"; done < <(grep '^/' .github/CODEOWNERS) — no output).

#524 — CONTRIBUTING.md documents no way to run the backend e2e suite or the security scans

• Added a Backend E2E Tests section: where the specs live (backend/test/), the Jest config (backend/test/jest-e2e.json), the run commands (npm run test:e2e, make test-backend-e2e, single-spec filtering), and the Postgres/Redis requirement.
• Added a Running the full check suite section covering:
  • make ci as the one-command entry point
  • backend unit tests and e2e suite (required)
  • onchain cargo fmt / cargo build / cargo test (required)
  • cargo deny --locked check advisories licenses bans sources (required)
  • npm audit --audit-level=critical (required) vs --audit-level=high (advisory)
  • gitleaks secret scanning (advisory)
• Each check is marked required or advisory with the originating workflow file (.github/workflows/build.yml / .github/workflows/security.yml) named, and SECURITY.md is linked for the security-gate status.

Remaining issues (not in this PR)

• Two entity classes both map @Entity('puzzles') with different column shapes #534 (duplicate @Entity('puzzles') classes): consolidating the two entities changes the TypeORM schema for the puzzles table and needs an explicit data migration plus repointing the migration module — an architecture change beyond docs.
• Security-headers CSP allows unsafe-inline and unsafe-eval scripts in every environment #527 (CSP unsafe-inline/unsafe-eval): needs an environment-scoped policy split (production strict vs development relaxed) and Swagger /docs exception design.

These remain open for a focused backend PR.

Acceptance criteria covered

• CODEOWNERS lists onchain paths that do not exist and calls the Rust contracts Cairo #520: Every path in CODEOWNERS exists in the repository
• CODEOWNERS lists onchain paths that do not exist and calls the Rust contracts Cairo #520: The onchain section names the correct language and paths
• CODEOWNERS lists onchain paths that do not exist and calls the Rust contracts Cairo #520: No template placeholder text remains in the file
• CONTRIBUTING.md documents no way to run the backend e2e suite or the security scans #524: CONTRIBUTING.md names every command needed to reproduce the CI checks that exist
• CONTRIBUTING.md documents no way to run the backend e2e suite or the security scans #524: Advisory versus required status is stated per check
• CONTRIBUTING.md documents no way to run the backend e2e suite or the security scans #524: The commands in the document run as written (Makefile targets and npm scripts verified against Makefile, backend/package.json, and the workflow files)

Closes #520
Closes #524
closes #534
closes #527

[drips-wave]

@DanielCharis1 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[dzekojohn4]

LGTM