Enable private key export and import

[0xnullifier]

Closes one part of #64

It changes the seed phrase derived client seed to be used for only secret key generation and thus enables export and import purely based on private keys

Closes Feedback Issue

[0xnullifier]

Marking as draft as this will build upon #78

In general, the fix is to explicitly add a permissions block to the workflow so that the GITHUB_TOKEN has only the minimum required permissions. We can do this at the workflow root (applies to all jobs) and/or at individual jobs. Here, the ci, coverage, and i18n-check jobs only need read access to repository contents, while the translations job needs to be able to push commits, so it needs contents: write.

The simplest change without altering functionality is:

• Add a root-level permissions block setting contents: read so all jobs default to read-only access.
• Add a permissions block inside the translations job overriding this default with contents: write so that git push continues to work.
• No other jobs need additional permissions, so they can rely on the restrictive root-level setting.

Concretely:

• In .github/workflows/pr.yml, insert a root-level permissions: section after the on: block.
• In the translations job definition, add permissions:\n contents: write under runs-on: ubuntu-latest.

No imports or extra methods are necessary, as this is purely YAML configuration.

To fix the problem, explicitly declare minimal GITHUB_TOKEN permissions so the workflow does not fall back to repository defaults. The safest and simplest change, without altering behavior, is to add a workflow‑level permissions block that grants only read access to repository contents. This will apply to all jobs unless a specific job overrides it. Since the shown jobs (ci, coverage, i18n-check) only check out code and run Node/Yarn/Playwright commands, they only need contents: read.

Concretely:

• Edit .github/workflows/pr.yml.
• After the name: PR Tests line and before the on: block, add:

permissions:
  contents: read

This keeps the change localized, avoids modifying any job steps, and ensures the coverage job (and the others) run with least privilege. No imports or extra methods are needed; it’s purely a YAML configuration change.

In general, the problem is fixed by explicitly defining a permissions: block so that the GITHUB_TOKEN has only the minimal permissions required. For this workflow, most jobs only need read access to repository contents, while the translations job performs a git push and therefore needs contents: write.

The best way to fix this without changing existing functionality is:

1. Add a workflow-level permissions: block right after the name: (before on:) that sets contents: read. This will apply to all jobs by default (ci, coverage, i18n-check, and even translations unless overridden).
2. Add a job-level permissions: block under the translations: job that elevates its permission to contents: write, since it commits and pushes translation files. This keeps the other jobs at read-only while allowing translations to continue pushing changes.

Concretely:

• Edit .github/workflows/pr.yml.

• Insert:

  permissions:
    contents: read

  between line 1 (name: PR Tests) and line 3 (on:).

• Under translations: (line 13), after the name: (line 14), insert:

      permissions:
        contents: write

No additional imports, methods, or external definitions are required; this is purely a YAML workflow configuration change.

---