feat(api): paginate & filter GET /loans and GET /groups (closes #3)

[Vyacheslav-Tomashevskiy]

Closes #3.

Problem

GET /api/loans and GET /api/groups returned all records with no bound — slow responses and heavy memory use once a group has hundreds of contributions or there are thousands of loans.

Changes

• Reusable PaginationQueryDto (src/common/dto/pagination-query.dto.ts): page (>=1, default 1) and limit (1-100, default 20). Built on the existing global ValidationPipe({ transform: true }), so ?page=&limit= strings are coerced to numbers and a limit > 100 is rejected with 400 automatically (@Max(100)).
• paginate() helper returns the standard envelope: { "data": [...], "meta": { "page": 1, "limit": 20, "total": 143, "totalPages": 8 } }.
• Loans (FindLoansQueryDto extends PaginationQueryDto): pagination + sortBy=amount|requestedAt & order=asc|desc (defaults requestedAt desc, preserving current behaviour), keeping the existing groupId / status filters. sortBy/order are whitelisted with @IsIn so no arbitrary field reaches Prisma's orderBy.
• Groups: pagination applied to findAll(); on-chain balance enrichment now runs only over the current page, not the whole table.
• Page rows and total count are fetched together in a single prisma.$transaction([...]).
• Swagger @ApiQuery added for every new param on both controllers.

Tests

Added a jest setup (repo had none) and 10 unit tests, all green (npx jest):

• pagination-query.dto.spec.ts — numeric coercion, limit > 100 rejected, < 1 rejected, non-integer rejected, envelope math.
• loans.service.spec.ts — defaults, skip/take/where/orderBy derivation, totalPages 0 on empty.
• groups.service.spec.ts — pagination + per-page balance enrichment.

Acceptance criteria

• Both endpoints paginated
• Response includes meta object
• Default page 1, limit 20
• Max limit 100 (rejects >100 with 400)
• Swagger docs updated (@ApiQuery for all params)
• Unit tests for service layer with page/limit params

Scope kept tight: no unrelated changes. The 3 pre-existing tsc errors (stellar.service.ts, notifications.service.ts) are on main already and untouched here; the added files type-check clean.

[Vyacheslav-Tomashevskiy]

Rebased onto latest main (past the JWT auth guard + Soroban indexer merges). Resolved the controller conflicts by keeping the new @UseGuards(JwtAuthGuard)/@ApiBearerAuth() on the write endpoints while preserving pagination on the list endpoints. All 15 unit tests pass locally. Ready for review.