feat(finance): BTC basket flows, client scoping, and jewelry-box store

- Finance API: baskets, holdings, rebalances, deposits, bridge withdrawals, vault checks.
- Schemas: btc-basket; api-client finance types; workspace lockfile update.
- Vitest config for finance service; expanded tests.

Made-with: Cursor

packages/test-utils/src/security-helpers.ts

@@ -77,9 +77,9 @@ export function createSecurityTestData() {
 export async function testAuthenticationBypass(
   makeRequest: (headers?: Record<string, string>) => Promise<{ status: number }>
 ): Promise<boolean> {
-  const testCases = [
+  const testCases: Array<Record<string, string> | undefined> = [
     // Missing token
-    {},
+    undefined,
     // Invalid token
     { Authorization: 'Bearer invalid-token' },
     // Expired token
@@ -226,4 +226,3 @@ export async function testCSRFProtection(
   
   return true; // CSRF protection is working correctly
 }
-