feat: Add security, linting, and threat-model enhancements

[ssins2013-dotcom]

Summary

This PR addresses 4 security and infrastructure improvements across the AtomicIP project:

• Add JS lint/format check to CI #914: Added ESLint and Prettier configuration for consistent JS code formatting with CI integration
• Add a security review checklist item for every re-enabled disabled test module #913: Added mandatory security review checklist for re-enabling disabled test modules (escrow, upgrade, batch-swap tests)
• Add a threat-model section for the JS batch layer's trust boundary #912: Expanded threat model to cover the JS batch processing layer with trust boundary analysis
• Add secret-scanning for API keys/credentials in commits #911: Integrated Gitleaks secret scanning into CI to detect leaked API keys, Stellar keypairs, and credentials

Test Plan

• ✅ ESLint and Prettier configs are applied without errors to existing JS modules
• ✅ Security checklist is documented in SECURITY.md for future test re-enablement
• ✅ Threat model section provides complete coverage of JS batch layer risks
• ✅ Gitleaks configuration detects common secret patterns and integrates cleanly with CI

Changes

Commit 1: Add ESLint and Prettier configuration (#914)

• .eslintrc.json: Style rules for consistent formatting
• .prettierrc / .prettierignore: Automated formatting config
• package.json: Added lint/format npm scripts
• .github/workflows/ci.yml: Added lint and format checks to CI

Commit 2: Add security review checklist (#913)

• SECURITY.md: Mandatory audit checklist for re-enabling disabled test modules
• Cross-reference to threat model and security procedures
• Identifies fund safety, authorization, and upgrade safety requirements

Commit 3: Add threat-model section for JS batch layer (#912)

• docs/threat-model.md: New section covering JS batch trust boundary
• 4 threat scenarios with mitigations (compromised host, state injection, replay, race conditions)
• Implementation checklist and operator recommendations
• Clarifies that batch processes prepare unsigned requests; API server holds signing authority

Commit 4: Add secret scanning with gitleaks (#911)

• .gitleaks.toml: Configuration with patterns for Stellar keypairs, JWT secrets, API keys
• .github/workflows/ci.yml: Integrated gitleaks-action to scan commits
• SECURITY.md: Documented secret scanning, incident response, and local scanning instructions

---

Closes #914
Closes #913
Closes #912
Closes #911

[drips-wave]

@ssins2013-dotcom Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits