Wallet signature authentication (challenge + verify)

[Cbiux]

Summary

Verify and fix wallet signature authentication end-to-end in production after #15 (DATABASE_URL) is configured.

Code is merged (SEP-53 challenge, JWT sessions, rate limits). Production auth still fails without DB and needs a final QA pass.

---

Implemented (do not re-build)

Layer	Files
Challenge + verify	Server/src/services/auth-challenge.service.ts
JWT sessions	Server/src/services/session.service.ts, session.middleware.ts
Auth routes	POST /api/auth/challenge, /register/signed, /login/signed
Front	Front/lib/wallet-kit.ts, wallet-auth-card.tsx, auth.ts, api-client.ts
Tests	Server/src/services/__tests__/verifyWalletSignature.test.ts, integration tests in CI

---

Production checklist

1. Provision production MySQL and configure DATABASE_URL on Vercel #15 done — DATABASE_URL + JWT_SECRET on Vercel
2. Redeploy zcore-api and dapp-zcore
3. Confirm NEXT_PUBLIC_API_BASE_URL=https://zcore-api.vercel.app
4. Confirm NEXT_PUBLIC_STELLAR_NETWORK=testnet matches Freighter network
5. Full flow: connect wallet → sign challenge → land on /dashboard with JWT in sessionStorage

---

Acceptance criteria

• Register new wallet on prod returns 201 + data.token
• Login existing wallet returns 200 + data.token
• GET /api/user/{wallet}/profile with Authorization: Bearer returns 200
• Invalid signature returns 401 (not 500)
• Document any Freighter/xBull quirks in CONTRIBUTING.md

---

How to verify locally

npm run setup
npm run dev:server
npm run dev:front
# Use Freighter testnet wallet at http://localhost:3001/register

---

Out of scope

• New auth mechanism (JWT already shipped in Server-side JWT sessions after wallet signature auth #35)
• Mainnet wallet support

[Cbiux]

Implemented in main. See commits ffb801e through 52b02ab.

[Cbiux]

Reopened: SEP-53 verification was merged and deployed (df9c727) but register/login still fails in production for some wallets. Needs end-to-end debug: signature payload, API env (DATABASE_URL), network passphrase mismatch, and wallet kit response format.