feat(server): wallet-authenticated SEP-10 sessions

[TOMOKI977]

Refs #136

size:exception

Server half of wallet-authenticated sessions. Flutter and the Freighter check stay in a stacked PR. This is over the 400-line review budget on purpose: ten work-unit commits, one behavior each.

Summary

SEP-10 challenges sign a wallet in and Serverpod issues the session. Hire methods require that session and resolve the wallet from wallet_account. The template email sign-in is gone. config.json publishes the public auth values (G… signing address, domains, network), never the S… secret.

Work units

1. Models, migration and the AuthUser relation.
2. Config and secrets, fail closed at startup.
3. SEP-10 codec and the known vector.
4. authorityOf and the account-entry RPC read.
5. Challenge store and its contracts.
6. Verifier.
7. WalletIdp find-or-create.
8. Endpoint, service and rate limit.
9. WalletSessionWallet, requireLogin, and the EmailIdp removal.
10. api.md and AppConfigRoute.

Acceptance criteria

• A wallet that signs the challenge gets a session, and HireEndpoint.createHire works for it (integration test).
• An expired, reused, wrong-wallet or wrong-network challenge is rejected with a typed error.
• A bad signature is rejected, and no session is created.
• A caller cannot act on another wallet's hire.
• No password, email or wallet secret is stored or transmitted by this server flow.
• In Chrome on testnet, connecting Freighter creates a session. GIF attached. (PR 2)
• flutter analyze / flutter test pass. (PR 2)

Verification evidence

cd puls3_server && dart analyze --fatal-infos
# No issues found

cd puls3_server && dart test
# Two unrelated concurrency tests timed out at 30s under parallel load
# (chain_submission_store REL-002, escrow preparation race).
# Re-run alone: both files passed.

cd puls3_server && dart format --set-exit-if-changed .
# Clean after reflowing relay_protocol_test.dart

Notes for reviewers

• The endpoint is WalletAuthEndpoint (client.walletAuth). A generated Client.auth would shadow the auth extension.
• Expiry is 900 seconds, not 5 minutes. Verification is a SEP-10 transaction signature (signedChallengeXdr), not signMessage.
• A wrong-network client signature leaves the body unchanged, so the reason is noClientSignature.
• Sign-out revokes the refresh token. The access JWT stays valid until it expires; the next hire call with no session is HTTP 401.
• FailClosedSessionWallet remains a test double. Production uses WalletSessionWallet.

[cloudflare-workers-and-pages]

Deploying puls3 with    Cloudflare Pages

Latest commit:	6443b0a
Status:	✅  Deploy successful!
Preview URL:	https://dd88311d.puls3-4lw.pages.dev
Branch Preview URL:	https://feat-136-wallet-sessions-01.puls3-4lw.pages.dev

View logs

[moises-cisneros]

Summary of Review

Reviewed and validated against PR #77 (docs/architecture/api.md) and OpenSpec Change #136 (specs/wallet-auth/spec.md, design.md, tasks.md).

Verification & Test Execution

• Static Analysis: dart analyze --fatal-infos passes cleanly with 0 issues across puls3_server, puls3_client, and puls3_domain.
• Formatting: dart format --set-exit-if-changed . clean (0 files changed).
• Test Suite: Executed the full test suite against PostgreSQL and Redis test instances (756 tests passed, 0 failures). Integration suites wallet_auth_endpoint_test, wallet_idp_test, wallet_session_hire_test, and challenge_store_test all run clean.
• Scenarios: Formal scenarios W1 through W31 are fully verified and covered by tests.

Architecture & Design Alignment

1. Rate Limiting & Challenge Lifecycle:
   • createChallenge rate limiting (5 attempts/min per target wallet) strictly follows OpenSpec D14 / Scenario W5.
   • Deferring cleanup of unconsumed/expired challenges was deliberately scoped out in design.md:157 and tasks.md:30. Recommend a non-blocking follow-up issue for a background cleanup job and evaluating IP-level rate limiting at the reverse proxy layer.
2. Signature Verification & Atomicity:
   • Sep10Verifier correctly enforces that all client signatures belong to authorized signers on chain (Scenario W11 / rule 5).
   • Atomic consumption in ServerpodChallengeStore.consume checks expiresAt > now inside the database transaction, preventing race conditions and replay attacks.
3. Session & Endpoint Integration:
   • Clean transition to WalletSessionWallet resolving the bound wallet from wallet_account. Replaces the template email IDP cleanly.

Minor Non-blocking Follow-ups

• puls3_server/README.md: Contains minor stale documentation referencing FailClosedSessionWallet as active in production and emailSecretHashPepper (lines 77-80, 407). Can be updated in a follow-up doc polish.
• WalletAuthEndpoint._service: Rebuilds TokenManager per request; consider reusing a shared instance in a future optimization pass.