fix(streams): enforce sender ownership on createStream (#809)

[jadonamite]

Fixes #809

Problem

createStream wired requireAuth but never read req.user. It called prisma.stream.upsert keyed only on the client-supplied streamId, whose update branch set { isActive: true }. So any logged-in wallet could:

• POST { streamId: <someone else's cancelled stream>, ... } and flip isActive back to true (the body's sender/recipient are ignored on update), and
• insert rows with an arbitrary sender it does not own.

Fix

• Reject 401 when unauthenticated and 403 when the JWT subject (req.user.publicKey) is not the body sender.
• Validate sender / recipient / tokenAddress before any DB write.
• Before the upsert, look up the existing row and reject 403 if it is owned by another wallet, so the update branch can never reactivate or overwrite someone else's stream.

Tests

Added controller tests covering: unauthenticated (401), caller≠sender (403), missing sender (400), and a non-owner attempting to reactivate a victim's cancelled stream (403, no DB write). All stream.controller.test.ts tests pass.

Acceptance criteria

• createStream rejects (403) when req.user.publicKey is not the body sender
• The upsert update branch no longer unconditionally sets isActive:true for an existing stream owned by someone else
• Integration test proving a non-owner cannot reactivate a cancelled stream via POST /v1/streams
• sender/recipient/tokenAddress validated before any DB write