feat: wallet signature verification middleware for API auth (closes #41)

[Tyler7x]

Summary

Implements Ed25519 Stellar wallet signature verification middleware for all state-changing API endpoints, closing the critical authentication bypass described in issue #41.

Changes

Backend

• web_app/api/wallet_auth.py (existing) — nonce generation, Ed25519 verification, verify_wallet_signature FastAPI dependency, GET /api/auth/nonce endpoint
• web_app/api/dependencies.py — re-exports verify_wallet_signature alongside get_stellar_client for clean import paths
• web_app/api/user.py — added Depends(verify_wallet_signature) to POST /api/update-user-contract and POST /api/subscribe-to-notification (previously unprotected)
• position.py and vault.py were already protected

Frontend

• services/wallet.jsx — adds signNonce(nonce, walletId) using Freighter's signMessage API; converts base64 → hex to match backend bytes.fromhex()
• utils/axios.js — adds getAuthHeaders(walletId): fetches nonce from /api/auth/nonce, signs it, returns x-wallet-id / x-nonce / x-signature headers
• services/transaction.js — POST /api/create-position now includes auth headers
• services/contract.js — POST /api/update-user-contract now includes auth headers

Tests

• tests/test_positions.py — removed module-level app.dependency_overrides.clear() that was wiping the bypass_wallet_auth autouse fixture and causing auth failures on protected endpoints
• tests/conftest.py (existing) — bypass_wallet_auth autouse fixture keeps all existing test suites decoupled from real crypto; test_wallet_auth.py covers the full auth flow with 23 unit tests

Test Results

• ✅ 23/23 wallet auth unit tests pass
• ✅ All position/vault endpoint tests pass with the auth bypass fixture
• ✅ 1 pre-existing DB-connection failure in test_positions.py (no local Postgres) — unchanged from main

Acceptance Criteria

• POST/PUT/DELETE endpoints require valid Ed25519 signature matching claimed wallet_id
• GET endpoints for public data remain unauthenticated
• Invalid signatures return 401 Unauthorized with descriptive error
• Expired nonces return 401 Unauthorized with clear message
• Frontend updated to include signature in API requests
• All existing tests pass (updated to include auth fixtures)

[YaronZaki]

✅ Nice work, @Tyler7x — challenge/response using Freighter signMessage plus a FastAPI dependency is exactly the right shape. Test mocks line up with the changes. Merging.