feat: agent type safety, notification alignment, contract migration, ci setup (#139 #140 #171 #179)

[dimka90]

Summary

Combined PR implementing 4 issues from the additional audit report.

---

#139 [Agent 17] — Remove unsafe type assertions on private clients

• Added parseValidatedGoal() helper that narrows types via runtime typeof checks instead of as number / as string casts
• Replaced all unsafe casts in registerUserGoal() and updateUserGoal() with calls to the typed helper
• GoalPayloadInput (all unknown fields) is now consumed through a properly typed ValidatedGoalData interface
• sendMessage() and broadcastMessage() remain public — no need for external as any access

#140 [Agent 18] — Align server notification type with frontend

• Added ErrorNotification type (was missing in frontend — server sends { type: 'error', payload: { message } })
• Fixed ConnectedNotification.payload shape to match server ({ userId, timestamp })
• Added ProactiveNotificationPayload interface with full type, projection, etc.
• Updated AgentMessagePayload to include sender: 'agent' and projection fields
• Added type guards: isErrorNotification, isProactiveNotification, isPongNotification
• Removed catch-all GenericNotification — all incoming messages are now strictly typed

#171 [Contract 24] — Migrate tests from register_contract to register

• Changed all 41 calls from env.register_contract(None, X) to env.register(X, ())
• Uses the newer soroban-sdk 22 API

#179 [CI DevOps 07] — Use npm ci instead of npm install

• CI pipeline already used npm ci — no change needed there
• Updated README.md setup instructions from npm install to npm ci for consistency

Files changed

File	Change
agent/websocket-server.ts	Added ValidatedGoalData, parseValidatedGoal(); removed as casts
frontend/src/types/websocket.ts	Full rewrite with proper types for all server messages
contracts/src/lib.rs	41 register_contract → register calls
README.md	npm install → npm ci in setup instructions

Closes #139
Closes #140
Closes #171
Closes #179

[drips-wave]

@dimka90 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits