feat: add audit logging, input sanitization, error reporting, and distributed tracing

[umuewu]

Description

Implemented audit logging for sensitive wallet actions, input sanitization for extension connection requests, error reporting integration for extension background worker, and distributed tracing for policy deployment flow.

Closes #313
Closes #312
Closes #302
Closes #301

Changes proposed

What were you told to do?

Add audit logging, input sanitization, extension background worker error reporting, and end-to-end distributed tracing across api-gateway, policy-service, and worker-service.

What did I do?

Audit Logging (#313)

• Updated \services/wallet-service/src/repository.ts\ and \server.ts\ to log sensitive wallet actions (\policy.updated, \�ccount.merged, \key.rotated, \ hreshold.updated, \signer.added, \signer.removed).
• Added GET /wallet/audit-logs\ endpoint and unit test suite.
• Documented audit log retention and access policy in \docs/decisions.md.

Input Sanitization (#312)

• Added \�pps/extension/lib/sanitization.ts\ for HTML escaping, tag stripping, dangerous protocol filtering, and string truncation.
• Added unit tests in \�pps/extension/lib/sanitization.test.ts.
• Integrated input sanitization into extension request routing and popup rendering.
• Documented approach in \�pps/extension/README.md.

Error Reporting (#302)

• Created \�pps/extension/lib/error-reporter.ts\ capturing uncaught worker errors, version, and browser metadata.
• Added unit tests in \�pps/extension/lib/error-reporter.test.ts.
• Integrated error reporter into \�pps/extension/entrypoints/background.ts.
• Documented setup in \�pps/extension/README.md.

Distributed Tracing (#301)

• Implemented \packages/service-kit/src/tracing.ts\ (\withTraceSpan, \extractTraceContext, \injectTraceContext, \TraceCollector).
• Added unit tests in \packages/service-kit/src/tracing.test.ts.
• Instrumented \�pi-gateway, \policy-service, and \worker-service\ loop for end-to-end trace propagation.
• Documented tracing architecture in \docs/observability.md.

Check List (Check all the applicable boxes)

• My code follows the code style of this project.
• This PR does not contain plagiarized content.
• The title and description of the PR is clear and explains the approach.
• I am making a pull request against the main branch (left side).
• My commit messages styles matches our requested structure.
• The implementation was reviewed and confirmed to work as intended.
• I am only making changes to files I was requested to.

Screenshots / Validation Evidence

Implemented with full Vitest unit test coverage for audit logging, input sanitization, error reporting, and distributed tracing.

[drips-wave]

@umuewu Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[vercel]

@umuewu is attempting to deploy a commit to the david's projects Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

Hi @umuewu — thanks for the contribution!

We do not accept pull requests to the main branch. All contributions go to the dev branch, so I've automatically retargeted this PR from main to dev for you.

You don't need to reopen anything — your work is preserved and this PR now targets dev. Going forward, please set the base branch to dev when you open a PR. 🙏