Dispute workflow evidence bundle export

[Silver36-ship-it]

Closes #698

PR Title

feat: add signed dispute evidence bundle export

Summary

This PR adds a new dispute evidence export capability that produces a signed, deterministic evidence bundle for downstream review and verification.

What changed

• Added a new dispute evidence exporter service that:

  • builds a reproducible manifest for each artifact
  • computes SHA-256 hashes for artifact content
  • includes request-id chain and reviewer metadata
  • encodes artifact payloads as base64
  • signs the canonical manifest with HMAC-SHA256
  • emits an audit event when an export is created

• Added a new authenticated endpoint:

  • POST /api/v1/disputes/:disputeId/evidence/export

• Wired the dispute router into the app so the endpoint is available in the backend.

• Added regression tests for:

  • successful bundle creation
  • validation of missing/invalid input
  • signing behavior and audit logging

Security notes

• The bundle is signed to support integrity verification and downstream validation.
• The export uses environment-based signing configuration and is protected by the existing auth middleware.
• The implementation is designed to be deterministic and auditable, with manifest content derived from stored artifacts rather than transient runtime state.

Testing

• Added targeted unit tests for the exporter and route handler.
• Validation was attempted locally, but the environment was missing installed Jest/ts-jest dependencies at the time of execution.

[drips-wave]

@Silver36-ship-it Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[Silver36-ship-it]

Please merge PR in absence of no conflicts