[GangDev6707]

Summary

This PR adds comprehensive unit and regression test coverage for loanAccess middleware in backend/src/middleware/__tests__/loanAccess.test.ts, addressing cross-account tenant isolation between borrowers, multi-role access contracts, and parameter validation guards.

Closes #2092

Details of Changes

• Multi-Tenant Cross-Account Isolation:
  • Tests borrower cross-access prevention between distinct tenants (Alice cannot access Bob's loan via requireLoanBorrowerAccess or requireLoanOwner, and vice-versa), asserting 403 AppError with ErrorCode.ACCESS_DENIED.
• Unrelated User Access Rejection:
  • Validates that callers with arbitrary or non-privileged roles (borrower, investor, guest, auditor, or undefined role) are rejected with 403 ACCESS_DENIED when the caller public key does not match the stored borrower address.
• Privileged Roles in requireLoanBorrowerAccess:
  • Verifies that callers with admin or lender roles can inspect loan details without executing database queries (next() called immediately).
• Strict Single-Owner Contract in requireLoanOwner:
  • Asserts that requireLoanOwner strictly enforces loan ownership without role bypasses (rejecting admin or lender callers if they are not the recorded loan owner).
• Missing Parameter Guards:
  • Tests rejection of missing loanId parameter in both middlewares, asserting 400 Bad Request with Loan ID is required.

Verification & CI Proof

• npm run lint: Passed (0 errors)
• npm run build: Passed (0 errors)
• npm test -- src/middleware/__tests__/loanAccess.test.ts: 31/31 tests passing (100% green)