fix(users): replace mock profile helpers with Prisma persistence

[usmanimamu17-create]

Summary

Closes #10

The four /users/* endpoints were built on private helpers that returned fabricated fixtures (findUserById returned test@example.com, validatePassword returned false, updateUserPassword threw Not implemented). This PR replaces them with real Prisma lookups/updates and bcrypt password handling, and removes the profile fields the database cannot store (firstName/lastName/bio/avatar/status/isActive) from the User type, validation middleware, OpenAPI schemas, and docs.

Why

The controller had no persistence layer and the User interface disagreed with prisma/schema.prisma (which only has email, username, password, role, walletAddress, timestamps). Rather than add columns for fields nothing consumes, this PR removes the unstorable fields so the type, schema, validation, and docs all describe the same contract, and implements every endpoint honestly against Prisma. Password changes reuse the existing bcrypt.compare/bcrypt.hash pattern from auth.controller.ts; a wallet @unique conflict maps to 409 instead of the previous catch-all 500.

What was built

File	What it contains
src/controllers/user.controller.ts	Real findUserById/updateUserProfile/validatePassword/updateUserPassword/updateUserWallet helpers over Prisma; updateUserWallet translates a P2002 unique violation to a 409. Responses expose only persisted fields and never the password hash.
src/types/user.types.ts	User/PublicUserInfo/UpdateUserData aligned to the actual columns; removed UserStatus, CreateUserData, UpdateWalletData, UpdateUserRoleData, UpdateUserStatusData, UserFilterParams (all unused).
src/middleware/validation.middleware.ts	validateProfileUpdate now only accepts username (the sole mutable profile column).
src/docs/schemas.ts	User and UpdateUser OpenAPI schemas drop firstName/lastName/bio/avatar/isActive.
docs/API.md	GET /users/me, PATCH /users/me, plus new PATCH /users/password and PATCH /users/wallet examples reflect the persisted shape.
tests/user.controller.test.ts (+ integrations/ mirror)	Rewritten to assert Prisma-backed behavior for all four endpoints (including bcrypt hashing and the 409 wallet conflict).
tests/unit/validation.middleware.test.ts (+ integrations/ mirror)	Removed obsolete unsupported-field cases; added an assertion that unsupported fields are stripped.

Integration changes outside src/controllers/user.controller.ts

• src/types/user.types.ts — User/PublicUserInfo/UpdateUserData reshaped; unused types removed.
• src/middleware/validation.middleware.ts — profile-update schema narrowed to username.
• src/docs/schemas.ts — OpenAPI User/UpdateUser schemas corrected.
• docs/API.md — user endpoint examples corrected.

Acceptance criteria coverage

Profile

• GET /users/me returns the authenticated user's actual persisted row, not the test@example.com fixture. (findUserById → prisma.user.findUnique; tests/user.controller.test.ts)
• PATCH /users/me persists the validated fields via prisma.user.update and returns the updated row. (updateUserProfile; tests/user.controller.test.ts)

Password

• PATCH /users/password verifies the current password with bcrypt and persists the new hash. (validatePassword → bcrypt.compare, updateUserPassword → bcrypt.hash + prisma.user.update)
• A correct current password succeeds and an incorrect one returns 400. (tests/user.controller.test.ts)

Wallet

• PATCH /users/wallet persists the wallet address and returns it; a duplicate address returns an appropriate 4xx rather than 500. (updateUserWallet maps P2002 to 409; tests/user.controller.test.ts)

Contract

• The User type, Prisma schema, validation middleware, and docs/schemas.ts agree on the user fields. (unsupported fields removed consistently)

Tests

• Unit tests assert the real Prisma-backed behavior for all four endpoints, replacing any expectation of the mock fixture. (tests/user.controller.test.ts rewritten)

Documentation

• docs/API.md and the Swagger annotations reflect the actual persisted user fields. (docs/API.md + src/docs/schemas.ts)

Test plan

• pnpm test:ci — 274/274 passing
• pnpm exec tsc --noEmit — no type errors
• pnpm lint — no errors or warnings
• pnpm build — succeeds
• npx prisma generate — client regenerated (no schema change; ran to confirm)

Env vars / Notes

No new environment variables or config keys, and no migration: the change removes unsupported fields rather than adding columns. User.role is typed as string to avoid coupling this PR to the role-model defect (#4, which owns the Role enum reconciliation); the role value is passed through unchanged from the persisted row. JWT invalidation on password change is left unchanged (the existing stateless-JWT design does not blacklist tokens).

[merlik787-droi]

LGTM