feat: implement CORS middleware, Oracle role, and BlockchainService score bridge

[demilade18-git]

Summary

Closes #316

This PR implements four features assigned to demilade18-git in the /middleware package.

Changes

#316 — CORS Configuration Middleware

• Added CorsMiddleware (NestJS-injectable) and corsMiddleware() factory function
• Supports configurable origins (wildcard or allowlist), methods, headers, credentials, and maxAge
• Handles OPTIONS preflight with 204 response and Access-Control-Max-Age
• Exported from security/index.ts

#295 — Admin/Oracle Role for Trusted Score Submission

• Added ORACLE to the UserRole enum in rbac.middleware.ts
• ORACLE inherits USER permissions and is granted trusted score submission rights
• ADMIN inherits all roles including ORACLE

#301 — BlockchainService Bridge (Backend → Stellar Contract)

• Added ScoreSubmissionBridge service — the missing link between backend score verification and the Stellar Soroban contract
• Enforces ORACLE or ADMIN role before calling submitPuzzleOnChain
• Validates score is within the 0–100 range
• Registered and exported from BlockchainModule

#279 — Frontend Animations & Polish

• No middleware-layer changes applicable; this is a pure frontend (Next.js) concern and is tracked separately

Files Changed

• middleware/src/security/cors.middleware.ts (new)
• middleware/src/security/index.ts
• middleware/src/auth/rbac.middleware.ts
• middleware/src/blockchain/score-submission.bridge.ts (new)
• middleware/src/blockchain/blockchain.module.ts
• middleware/src/blockchain/index.ts

Test Plan

• CORS headers present on cross-origin requests
• Preflight OPTIONS returns 204 with correct headers
• ORACLE role passes rbacMiddleware([UserRole.ORACLE]) check
• ORACLE role is blocked from rbacMiddleware([UserRole.MODERATOR]) routes
• ScoreSubmissionBridge.submitTrustedScore succeeds with ORACLE/ADMIN role
• ScoreSubmissionBridge throws ForbiddenException for USER/MODERATOR roles
• Score outside 0–100 range throws an error

🤖 Generated with Claude Code

[drips-wave]

@demilade18-git Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits