fix: enforce ownership on campaign update (IDOR)

[Adeolu01]

Closes #19

CampaignsService.updateCampaign accepted a userId but never used it, so any authenticated wallet holder could overwrite the title, description, story, and imageUrl of every campaign — a textbook OWASP A01:2021 Broken Access Control / IDOR, with imageUrl/story usable for phishing injection and no audit trail.

Changes:

• Enforce per-resource ownership in updateCampaign: reject with 403 Forbidden unless the caller is the campaign creator or an admin, mirroring the existing deleteUpdate admin-flag pattern.
• Fix the controller passing the wrong identity (req.user.id, which is undefined) — now uses req.user.sub and derives isAdmin from req.user.role.
• Write an AuditLog row (CAMPAIGN_UPDATED) on every successful update recording actor, target campaign, and the applied diff.
• Add regression tests asserting 403 when wallet A edits a campaign owned by wallet B (including the coverImageUrl/phishing case), plus owner-success and admin-override coverage.

Note: @Roles('CREATOR','ADMIN') was intentionally not added to the route — campaign creation does not promote a USER to CREATOR, so that decorator would lock legitimate owners out of their own campaigns. Per-resource ownership is the correct boundary.

[Alqku]

@Adeolu01 please fix the CI thanks.

[Alqku]

Clean, focused IDOR fix — the ownership check + audit log is exactly the right shape. Thanks for picking this up 🙌

[Alqku]

Heads up: this now has a merge conflict on src/campaigns/campaigns.service.ts (and a couple of related files) after we landed #32. Could you rebase onto current main and push again? Once the conflict is resolved and CI is clean, I\u2019ll merge right away \u270d\ufe0f

[Adeolu01]

@Alqku done. I merged current main into the branch, resolved the conflict, and CI is now fully green.

Summary of what was needed:

• Resolved the src/campaigns/campaigns.service.spec.ts add/add conflict by keeping both suites side by side: the updateCampaign access-control tests from this PR and the milestone target-validation tests from main. All access-control assertions (403 IDOR, phishing coverImageUrl, owner success, admin override) are intact.
• The other campaign files (campaigns.service.ts, campaigns.controller.ts) merged cleanly, so both the IDOR fix and the milestone validation from main coexist.
• Fixed two pre-existing CI issues that were blocking every job:
  • The workflow file had a duplicate env: key on the Jest e2e step, which made Actions reject the whole file so no jobs ran. Merged it into a single valid env block.
  • The e2e suite passed but Jest never exited (the booted Nest app holds open Redis/Bull/scheduler handles), so the job hung until the 15-minute timeout and was reported as cancelled. Enabled forceExit in the e2e Jest config so the process ends once tests finish.

All six checks (Build, Lint, Format, Prisma validate, unit, e2e) are passing and the branch is mergeable. Ready for merge whenever you are.