test: add comprehensive refund splitting tests for cancel_stream

[Kenlachy]

• Add 14 tests covering boundary conditions and edge cases for refund splits
• Test scenarios: immediate cancel, full vesting, partial vesting, withdrawals
• Cover paused streams, draft streams, small/large amounts, multiple withdrawals
• Include error cases: already settled, already cancelled, nonexistent stream
• Verify sender/recipient split: recipient gets vested - released, sender gets unvested
• Add test documentation with coverage goals and verification approach

Security Changes

Type of Security Change

• SAST rule update
• Dependency vulnerability fix
• Exemption addition/renewal
• Security workflow modification
• Container image update
• Other: _______________

Vulnerability Details (if applicable)

CVE/Advisory ID:

• CVE-ID:
• GHSA-ID:

Affected Package:

• Name:
• Version:
• Severity: [ ] Critical [ ] High [ ] Medium [ ] Low

Fix Applied:

• Package version bump
• Code change to mitigate
• Configuration update
• Exemption granted (see below)

Exemption Request (if applicable)

Exemption ID: EXEMPT-___

Justification:

Mitigation Applied:

Expiry Date: YYYY-MM-DD (max 90 days from now)

Review Plan:

Testing

• Ran npm audit locally - output attached or no new vulnerabilities
• Security workflow passes on this branch
• Test suite passes: npm test
• Build succeeds: npm run build

Security Impact Analysis

Affected Components:

• Authentication/Authorization
• Payment processing
• Data encryption
• API endpoints
• Dependencies
• Container images
• CI/CD pipeline
• Other: _______________

Risk Assessment:

Documentation Updates

• Updated README.md (if workflow changed)
• Updated SECURITY-CI-SETUP.md (if process changed)
• Updated security-exemptions.json (if applicable)
• Added security notes to code comments

Checklist

• No secrets or keys committed
• No PII or sensitive data in logs
• All security scans pass (or exemptions documented)
• Branch protection requirements met
• Code review from security team (for critical changes)

Additional Notes

Test Output

# Paste npm test output here
npm test

# Paste npm audit output here (if relevant)
npm audit

CI Run Link

Workflow Run:

---

Security Review Required: @security-team
Compliance Impact: [Yes/No - explain if yes]
closes #938

[drips-wave]

@Kenlachy Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[greatest0fallt1me]

Perfect. LGTM ✨ merging now.