chore: stack upgrade

[hieu-w]

Jira Link

Description

Stack upgrade: Node 24, latest deps, remove elliptic/buffer/bn.js.

• Node & runtime: .nvmrc → >=24.x; package.json engines node >= 22.x; Dockerfiles and CI workflows use Node 24.
• Dependencies: Removed elliptic, bn.js, nodemon; added @toruslabs/metadata-helpers; upgraded Sentry to v10, eccrypto to v7, and other deps to latest.
• Crypto: Replaced direct use of elliptic, Buffer, and bn.js with @toruslabs/metadata-helpers and native APIs in src/utils/index.ts (signature verification via coordsToPublicKey, secp256k1.verify, compact sig first 64 bytes) and src/routes/metadata.ts (nonce generation, batch size via utf8ToBytes). Tests use bytesToBigInt, encodeMessageBytes, and BigInt for timestamps.
• Other: Redis get casts to string in socket/lock/metadata routes; ESLint import/no-extraneous-dependencies relaxed for test/config files.

How has this been tested?

• npm run test:ci (Docker Compose + vitest): all 18 tests pass.

Screenshots (if appropriate)

N/A — backend only.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)

Checklist

• My code follows the code style of this project. (run lint)
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have added tests to cover my changes.
• All new and existing tests passed.

---

Note

Medium Risk
Upgrades the runtime/tooling baseline (Node 22→24) for CI and production images, which can surface dependency/runtime incompatibilities at build or deploy time. Other changes are workflow/linters/ownership and are low risk.

Overview
Stack/tooling upgrade: CI workflows (any.yml, develop.yml, master.yml) now run on Node 24.x and use newer actions/checkout/actions/setup-node versions, and Docker images (Dockerfile, Dockerfile.dev) switch to node:24-alpine; .nvmrc is updated to >=24.x.

Repo hygiene: Adds .github/CODEOWNERS to enforce review ownership, removes nodemon.json, and updates ESLint to allow import/no-extraneous-dependencies for test/config paths.

^{Written by Cursor Bugbot for commit 753994e. This will update automatically on new commits. Configure here.}

[hieu-w]

torus-metadata-cursor_code_review_against_master.md

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}