Fix/1365 settlement authorization validation

[sherifatolanike]

Summary

Strengthens authorization and input validation for settlement receipts and transaction history before sensitive UI actions and API calls.

Changes

• Validate commitment route parameters at the boundary

• Validate wallet identity before sensitive operations

• Validate the connected network

• Validate numeric transaction and settlement values

• Validate server responses before consuming settlement data

• Enforce ownership and authorization checks instead of relying on client state

• Added protection and regression coverage for:

  • Replay attempts
  • Tampered inputs
  • Wrong-network wallet
  • Disconnected wallet
  • Malformed server responses
  • Invalid route parameters
  • Retry scenarios
  • Permission/authorization failures

• Preserved existing successful settlement and transaction-history behavior

Validation

npm test
npm run lint
npm run typecheck

Focused settlement tests were also executed where available.

Design Tradeoffs

Validation is performed at the boundary so malformed or unauthorized data is rejected before reaching sensitive settlement operations.

Client-side wallet state is treated as input rather than proof of ownership or authorization.

Limitations

Any pre-existing CI failures unrelated to settlement receipts or transaction history are documented and were not modified as part of this issue.

Acceptance Criteria

• Normal and adversarial inputs are validated
• Route parameters, wallet identity, network, numeric values, and server responses are validated
• Authorization and ownership assumptions are explicitly checked
• Replay and tampering scenarios are covered
• Wrong-network and disconnected-wallet scenarios are covered
• Malformed responses are covered
• Success, failure, boundary, retry, and permission behavior are tested
• Validation commands and results are included
• Design tradeoffs and limitations are documented

closes #1365