feat: claim evidence URL + SHA-256 commitment (file_claim, events, st…

[Jambox11]

Summary

Adds a content commitment for claim evidence: each attachment is { url, hash } with a 32-byte SHA-256 digest. The contract stores the commitment and rejects an all-zero digest at filing; it does not fetch URLs or verify hashes on-chain. Off-chain services (IPFS proxy, NestJS) can fetch bytes and compare digests.

Contract (niffyinsure)

• New ClaimEvidenceEntry (url: String, hash: BytesN<32>); Claim.image_urls replaced by Claim.evidence.
• file_claim(..., evidence) validates URL limits and non-zero hash per entry.
• ClaimFiled emits evidence_hashes: Vec<BytesN<32>> (same order as evidence); removed FNV image_hash u64.
• validate::Error note: Soroban contracterror is at max variant count, so all-zero hash maps to existing ExcessiveEvidenceBytes with an updated human message in map_quote_error.
• Doc: contracts/niffyinsure/docs/claim_evidence_hash.md.
• Tests: zero-hash rejection, persistence on get_claim, shared tests/common helpers; snapshots updated. cargo test -p niffyinsure passes.
  closes Contract — Claim evidence hash commitment: SHA-256 digest alongside URL #186

Backend

• build-transaction accepts evidence: [{ url, contentSha256Hex }]; Soroban encoding in file-claim-evidence.ts.
• IPFS upload response includes contentSha256Hex (hash of bytes actually uploaded after EXIF strip); idempotency cache stores it for new uploads.
• contentMatchesSha256Commitment() for verification against fetched content.
• Golden vectors + scripts/refresh-vectors.ts updated.
• Event catalog: ClaimFiledEvent.evidence_hashes replaces image_hash.
• Indexer: repaired broken handleClaimFiled duplication; ClaimFiled handler currently logs only (payload/topics don’t carry enough for a full DB upsert without get_claim backfill).

Frontend

• Claim wizard / API: evidence with contentSha256Hex from upload; vote schema uses evidence instead of image_urls.

How to test

• cd contracts/niffyinsure && cargo test -p niffyinsure
• cd backend && npx jest src/soroban/golden-vectors.test.ts src/events/events.test.ts

Follow-ups (optional)

• Indexer: upsert claims from ClaimFiled + get_claim (or extend on-chain event) so DB rows stay in sync.
• Full backend nest build still has unrelated existing TS issues in this repo; contract + selected Jest suites above are the focused checks for this PR.

[drips-wave]

@Jambox11 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits