fix(security): swagger route path safety, localStorage encryption, and horizon fallback verification

[wowamaxe-glitch]

Closes #333
Closes #335
Closes #326

Summary of Changes

This PR addresses three security issues on moistello-frontend:

1. Swagger Route Path Hardcoding & Path Disclosure (Fixes fix(security): make swagger route robust instead of reading a hardcoded absolute server path #333)

   • Updated GET /api/swagger in src/app/api/swagger/route.ts to replace the hardcoded server path (/opt/moistello/backend/...).
   • Added support for SWAGGER_JSON_PATH / SWAGGER_PATH and SWAGGER_BACKEND_URL / BACKEND_URL environment variables with safe relative defaults (docs/api/swagger.json, public/swagger.json).
   • If the spec is missing or unreadable, returns a standard 404 status with { error: "Swagger API specification not found" } without disclosing server filesystem paths.
   • Added unit test suite in src/app/api/swagger/__tests__/route.test.ts.

2. WebCrypto AES-GCM Encryption for Persisted Data at Rest (Fixes feat(security): encrypt wallet sessions and user profile at rest in localStorage #335)

   • Leveraged WebCrypto AES-GCM encryption in src/lib/security/encryption.ts to encrypt user profile and wallet session payloads stored in localStorage.
   • Updated WalletSessionManager in src/lib/wallet/session-manager.ts to use a consistent device-based passphrase seed so restore() and persist() match across reloads.
   • Updated useAuthStore in src/stores/auth-store.ts with getStoredUserAsync() to decrypt the user profile using WebCrypto AES-GCM on rehydration and handle tampered payloads gracefully by clearing stale storage.
   • Added unit test suite in src/lib/security/__tests__/encryption.test.ts covering round-trip encryption, decryption failure with wrong keys, and tamper detection.

3. Removal of Direct Third-Party Horizon Fallbacks (Fixes fix(security): remove direct Horizon fallback in balance-cache leaking wallet addresses #326)

   • Verified and ensured client-side fetchBalanceWithBackoff in src/lib/wallet/balance-cache.ts routes all wallet balance requests exclusively through the first-party proxy (/api/wallet/balance).
   • Confirmed no direct third-party Horizon requests leave the browser, keeping wallet addresses private and enforcing circuit breaker and retry limits.

Verification

• Ran Vitest unit test suites for route.test.ts, encryption.test.ts, auth-store.test.ts, session-manager.test.ts, and balance-cache.test.ts.
• All 36 test cases across the target modules passed cleanly.

[vercel]

Someone is attempting to deploy a commit to the Nzubechukwu 's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@wowamaxe-glitch Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits