Auth layer calls /auth/login and /auth/refresh-token

[KeNgKawthar]

PR Description — Align Frontend Authentication with Backend Wallet Challenge-Response

Summary

This PR replaces the frontend's unsupported email/password and refresh-token authentication flow with the wallet-based challenge-response authentication implemented by the backend.

The current frontend calls /auth/login, /auth/register, /auth/refresh-token, and other endpoints that do not exist in the backend. As a result, users cannot authenticate against the actual API, and session renewal is built around a nonexistent refresh-token flow.

This change aligns the frontend authentication layer with the backend's existing /auth/challenge and /auth/verify endpoints.

Changes

• Replaced the unsupported /auth/login flow with wallet challenge-response authentication.

• Added frontend support for:

  • GET /auth/challenge
  • POST /auth/verify

• Sign the backend-provided challenge using the connected Stellar wallet.

• Send walletAddress, signedChallenge, and challenge to /auth/verify.

• Store and use the returned accessToken as the Bearer token for authenticated API requests.

• Removed/replaced calls to unsupported:

  • /auth/login
  • /auth/register
  • /auth/refresh-token
  • /auth/social-login
  • /auth/me

• Reworked session expiry handling to trigger wallet re-authentication instead of attempting to refresh a nonexistent token.

• Updated authentication state management to work with the backend's wallet-based identity.

• Updated API types to match the backend response:

  • accessToken
  • tokenType
  • wallet-based user information

• Kept the existing OAuth/NextAuth flow separate since social authentication is outside the scope of this fix.

Testing

Added/updated coverage for:

• Requesting an authentication challenge.
• Signing the challenge with the connected wallet.
• Successfully completing /auth/verify.
• Storing the returned access token.
• Sending the access token with subsequent protected API requests.
• Rejecting/handling failed authentication attempts.
• Re-authenticating when the 15-minute access token expires.
• Verifying that the resulting token is accepted by a protected backend endpoint.

Validation

Run:

npm run type-check
npm run lint

Expected Outcome

The frontend and backend now use the same authentication contract.

A user can connect their Stellar wallet, sign the backend challenge, receive a valid access token, and use that token for protected API requests. When the token expires, the application prompts the user to authenticate again through the wallet rather than attempting to call the nonexistent /auth/refresh-token endpoint.

This removes the two incompatible authentication models and establishes the backend's wallet challenge-response flow as the working frontend authentication path.
Closes #5

[P3az3]

LGTM