feat(finance): BTC basket flows, client scoping, and jewelry-box store

- Finance API: baskets, holdings, rebalances, deposits, bridge withdrawals, vault checks.
- Schemas: btc-basket; api-client finance types; workspace lockfile update.
- Vitest config for finance service; expanded tests.

Made-with: Cursor

packages/test-utils/src/security-helpers.ts

@@ -77,9 +77,9 @@ export function createSecurityTestData() {
 export async function testAuthenticationBypass(
   makeRequest: (headers?: Record<string, string>) => Promise<{ status: number }>
 ): Promise<boolean> {
-  const testCases = [
+  const testCases: Array<Record<string, string> | undefined> = [
     // Missing token
-    {},
+    undefined,
     // Invalid token
     { Authorization: 'Bearer invalid-token' },
     // Expired token
@@ -226,4 +226,3 @@ export async function testCSRFProtection(
   
   return true; // CSRF protection is working correctly
 }
-

packages/test-utils/src/server-factory.ts

@@ -5,7 +5,6 @@
 
 import { FastifyInstance } from 'fastify';
 import Fastify from 'fastify';
-import { getEnv } from '@the-order/shared';
 
 export interface ServerFactoryOptions {
   port?: number;
@@ -41,4 +40,3 @@ export async function createTestServer(
 export function closeTestServer(server: FastifyInstance): Promise<void> {
   return server.close();
 }
-