[Abdulwasiu45]

Resolves #666 and #667.

Summary of Changes

Issue #667: Multisig assembleTransaction discards collected signatures

• Problem: assembleTransaction in src/stellar/multisig.ts was ignoring envelope.signatures and returning an unsigned base transaction, leading to on-chain failures for READY multisig envelopes.
• Fix:
  • Implemented decodeDecoratedSignature() to parse collected signatures from XDR base64 strings, { publicKey, signature }, { hint, signature }, or publicKey:signature formats into valid xdr.DecoratedSignature objects.
  • Updated assembleTransaction() to validate envelope status (READY), non-expired validity, and threshold satisfaction.
  • Attached all decoded signatures onto the base transaction without duplication.
  • Added comprehensive test suite in tests/unit/stellar/multisig.test.ts covering two-signer envelope fixtures, Ed25519 cryptographic verification against real Stellar keypairs, signature deduplication, and error conditions.

Issue #666: Structured logs emit PII without scrubbing

• Problem: Winston logger did not have field-level scrubbers or pattern scrubbers for emails, phone numbers, IP addresses, or wallet addresses in log payloads.
• Fix:
  • Implemented scrubPayload() and Winston format transform scrubFormat() placed at root level and transport level so log sampling and debug modes cannot bypass scrubbing.
  • Added deny-list redaction for sensitive keys (password, secret, token, authorization, cookie, apiKey, bearer, etc.).
  • Added pattern scrubbers for emails (redacting local-part while preserving domain for routing diagnostics), phone numbers, IPv4 (preserving /24 subnet telemetry) and IPv6, Stellar public keys (G... truncated to first/last 4), Stellar secret keys (S... fully redacted), EVM addresses (0x... truncated to first/last 4), and Stripe/Slack/Bearer tokens.
  • Documented log PII policy in docs/OBSERVABILITY.md and updated docs/DATA_RETENTION_POLICY.md.
  • Added 14 unit tests in tests/unit/utils/logger.test.ts validating PII scrubbing across strings, objects, circular references, child loggers, and raw log fixture output.

CI & Hygiene Verification

• Validated TypeScript compilation (npm run typecheck passes with 0 errors).
• Validated ESLint rules (npm run lint passes with 0 errors).
• Formatted with Prettier across all touched files.
• Verified test suites pass cleanly.

Closes #666
Closes #667