feat: Reject Incorrect Wallet Signature

[Olowodarey]

This PR replaces the placeholder signature validation logic in the wallet login flow with real Ed25519 cryptographic verification using the ring crate.

It also adds five focused integration tests to ensure that any mismatch between a wallet’s public key and the provided signature correctly results in a 401 Unauthorized response.

---

Problem

The wallet_login handler previously contained a stubbed signature check that only rejected the literal string:

"invalid_signature"

Any other string — including signatures produced by a completely different private key — would be accepted.

This meant an attacker could impersonate any wallet address, creating a serious authentication vulnerability.

---

Solution

1️⃣ Real Ed25519 Signature Verification

Updated src/auth.rs to perform proper cryptographic validation:

• wallet_address is treated as the hex-encoded Ed25519 public key
• signature is the hex-encoded Ed25519 signature
• The signature must be valid for the UTF-8 nonce previously stored in the database
• Verification is performed using:

ring::signature::UnparsedPublicKey::verify

Any verification failure (including wrong key, corrupted bytes, wrong message, or malformed input) now correctly returns:

401 Unauthorized

---

2️⃣ Dependency Updates

Updated Cargo.toml:

• Added:

hex = "0.4"

• Included in:

  • [dependencies] (used in auth.rs)
  • [dev-dependencies] (used in integration tests)

---

Test Coverage

Added 5 integration tests validating:

• ✅ Valid signature → authentication succeeds
• ✅ Signature signed by a different private key → 401 Unauthorized
• ✅ Corrupted signature bytes → 401 Unauthorized
• ✅ Wrong message signed → 401 Unauthorized
• ✅ Malformed hex input → 401 Unauthorized

These tests ensure authentication fails securely under all mismatch conditions.

---

closes #136

[ONEONUORA]

Nice implementation @Olowodarey