fix: strip secret key from offline queue, prompt on replay

[johnsaviour56-ship-it]

Summary

This PR fixes a critical security issue in frontend/src/hooks/useOfflineQueue.js where the full payment payload—including sourceSecret—was being persisted to localStorage. Since localStorage is accessible to any JavaScript running on the same origin, this exposed sensitive credentials to potential theft or XSS attacks.

Changes

1. Removed sourceSecret from all offline queue persistence logic
2. Updated offline queue to store only non-sensitive payment intent data:

• destination
• amount
• asset

3. Added flow to prompt users to re-enter their secret key when reconnecting online
4. Adjusted queue replay logic to require fresh authentication input before execution

Security Impact

• Prevents sensitive key exposure via browser storage
• Mitigates risk from XSS and malicious injected scripts
• Aligns frontend behavior with secure key management practices

Behavioral Impact

1. Before: Full payment payload (including secret key) stored in localStorage and replayed automatically
2. After: Only payment intent is stored; secret key must be re-entered after reconnection

Tests / Validation

• Verified offline payments queue without storing sensitive data
• Confirmed replay flow requires user re-authentication
• Ensured no regression in offline/online payment transitions

Acceptance Criteria

• sourceSecret removed from persisted offline queue
• Only payment intent data stored in localStorage
• User prompted to re-enter secret key on reconnect
• Offline payment flow remains functional without credential leakage

Closes #233

[drips-wave]

@johnsaviour56-ship-it Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits