feat(security): harden CSP, auth-flow concurrency, WC2 adapter, and HttpOnly auth persistence - #345

Summary of Changes

This pull request implements comprehensive security hardening, race condition mitigations, and architecture refactors addressing issues #336, #338, #339, and #340.

1. CSP Hardening and Strict Asset Allowlists (Closes #336)

• Problem: Permissive img-src wildcards (https:) and potential unsafe eval exposure allow external exfiltration and weaken CSP protection.
• Solution:
  • Hardened src/lib/security/csp.ts by replacing https: wildcard in img-src with strict origins (...configuredOrigins(), ...ANALYTICS_HOSTS, ...IPFS_HOSTS).
  • Retained strict nonce-based CSP directives across production and API routes, precluding unsafe-eval and unsafe-inline.
  • Updated CSP test assertions in src/lib/security/__tests__/csp.test.ts.

2. Auth Flow Concurrency & Atomic State Validation (Closes #338)

• Problem: Rapid or repeated submissions in auth-flow-store.signAndSubmit could initiate concurrent signing attempts or submit signatures against stale authentication states.
• Solution:
  • Implemented an isSigningInFlight concurrency guard preventing duplicate active sign/submit operations.
  • Added atomic state snapshot checks prior to message signing and final submission, ensuring mode, address, and walletId cannot change mid-flight.
  • Safely extract server nonces and passkey revocation responses.
  • Added test coverage in src/stores/__tests__/auth-flow-store-concurrent.test.ts and src/stores/__tests__/auth-flow-store-sign.test.ts.

3. WalletConnect Adapter Concurrency & Resource Lifecycle (Closes #339)

• Problem: Module-level shared pairing state in WalletConnect adapter led to race conditions on concurrent connection attempts and dirty state if unmounted mid-pairing.
• Solution:
  • Encapsulated pairing state into isolated PairingContext instances with abort controllers.
  • Ensured previous connection attempts are cleanly aborted when a new connection is initiated.
  • Refactored resetWcState() and disconnectWc() to avoid destructive global IndexedDB wipes, scoping resets strictly to active session contexts.
  • Aligned error typing with WalletError union (not_installed for disconnected states).
  • Added unit test suites src/lib/wallet/adapters/__tests__/wc2-context.test.ts and src/lib/wallet/adapters/__tests__/walletconnect.test.ts.

4. HttpOnly Cookie Authentication Token Lifecycle (Closes #340)

• Problem: Persisting sensitive auth tokens (access tokens, nonces, signatures) to localStorage exposed credentials to XSS extraction.
• Solution:
  • Updated useAuthFlowStore partialize configuration to strictly exclude auth (nonces and signatures) from localStorage.
  • Shifted token persistence to HttpOnly cookies managed via /api/auth/session endpoint, with in-memory token retention for tab session state.
  • Automated purging of legacy localStorage token keys (moistello_token, moistello_refresh, moistello_access_token, moistello_refresh_token) on store initialization.
  • Added comprehensive security unit tests in src/stores/__tests__/auth-security.test.ts.

Issue References

Closes #336
Closes #338
Closes #339
Closes #340

Verification

• Unit test suites passing:
  • src/lib/security/__tests__/csp.test.ts
  • src/lib/security/__tests__/api-csp.test.ts
  • src/lib/security/__tests__/middleware-csp.test.ts
  • src/lib/security/__tests__/middleware-dev-guard.test.ts
  • src/lib/security/__tests__/dev-only-route.test.ts
  • src/stores/__tests__/auth-flow-store-concurrent.test.ts
  • src/stores/__tests__/auth-flow-store-sign.test.ts
  • src/stores/__tests__/auth-security.test.ts
  • src/lib/wallet/adapters/__tests__/walletconnect.test.ts
  • src/lib/wallet/adapters/__tests__/wc2-context.test.ts
  • src/lib/wallet/adapters/__tests__/wc2-aggressive.test.ts
• Coverage verified across security and auth modules.