Add comprehensive contract

[Dev-journals]

PR Summary

The rbac.ts middleware creates its own new Pool() at module-load time — completely bypassing Jest's pg mock. When isolateOrganization ran inside route handlers, it tried to connect to the real (unavailable) PostgreSQL, causing the 500 errors.

Fix: Mock Both Middlewares

Added jest.mock('../middlewares/auth.js', ...) and jest.mock('../middlewares/rbac.js', ...) before any module imports, so the routes use test-safe pass-through implementations that never touch a database.

Architecture of the Test Suite

• In-memory stores (mockEventsStore, mockStateStore) simulate the DB
• global.fetch mock simulates the Soroban RPC getEvents endpoint
• jest.mock('pg') and jest.mock('../config/database.js') intercept all pool queries
• jest.mock for auth/rbac prevents middleware DB calls from escaping the sandbox

Closes #559

[Wilfred007]

Thanks for the work on this @Dev-journals — the scope of the changes looks substantial, and I appreciate the effort that went into the contract work.

Before we can merge, though, there are a couple of CI issues that need to be addressed.

First, npm run lint is failing with 11 errors and 1 warning in EmployeeEntry.tsx and EmployeePortal.tsx. Most of these are @typescript-eslint/no-unsafe-* errors where the employee API/client values are resolving to an error type. I’d recommend addressing the underlying API/client typing rather than suppressing the lint rules. There’s also an unused EmployeesApiResponse at EmployeeEntry.tsx:81, and the useEffect at line 109 is missing fetchEmployees from its dependency array.

Second, the Playwright job is failing with 32 tests. The clearest failure is e2e/tests/wallet.spec.ts, where Firefox times out waiting for #tour-connect to become clickable. The same run also shows failures across the employee and login/navigation tests, so it would be worth checking whether there is a common application initialization or rendering issue rather than treating these as isolated test failures.

Could you please investigate both the lint failures and the Playwright failures, then push an update and rerun CI? In particular, I’d like to see the underlying type issue and the reason #tour-connect is not available in the Firefox test environment resolved rather than worked around with lint/test suppressions.

Thanks again for the contribution!