feat(#60): implement custody lifecycle state machine with transition validation, timeline logging and trust score updates

[Clinton6801]

Closes #60

Changes

• Created CustodyStateMachine service with canTransition(), getValidTransitions(), assertCanTransition(), and getTransitionsMap() methods
• Transition map enforces valid flows:
  • PENDING → ACTIVE, CANCELLED
  • ACTIVE → RETURNED, CANCELLED, VIOLATION
  • RETURNED, CANCELLED, VIOLATION → terminal (immutable)
• Invalid transitions throw DomainException (HTTP 422) with clear from/to message
• Injected state machine into CustodyService — all status updates validated before execution
• Timeline events logged on every valid transition with fromStatus, toStatus, timestamp
• Trust score updated on transition: +5 for RETURNED, -15 for VIOLATION
• Registered CustodyStateMachine in CustodyModule providers and exports

Tests

• 30+ unit tests covering all valid and invalid transitions
• Terminal state immutability verified
• returnCustody() and violationCustody() integration tests
• Trust score and timeline logging verified in tests

Follows existing patterns

• Mirrors AdoptionStateMachine implementation
• Uses DomainException consistent with repo error handling

[drips-wave]

@Clinton6801 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[amina69]

@Clinton6801 build failed, please check