feature: Web3 wallet authentication

[anonfedora]

Description

Implements a complete Web3 wallet authentication system as a secure, non-custodial alternative to traditional email/password login. Users connect their MetaMask wallet, sign a server-issued cryptographic nonce, and receive JWT tokens upon successful signature verification — with no passwords stored or transmitted at any point.

The implementation covers the full stack: backend nonce generation and signature verification endpoints, frontend wallet connection service and UI component, database schema changes, rate limiting, and comprehensive documentation.

Backend

• GET /api/auth/nonce — generates a unique 32-character cryptographic nonce, persists it with a 5-minute TTL via the new AuthNonce Prisma model, and returns it to the caller
• POST /api/auth/verify — accepts a wallet address and signed message, cryptographically verifies the signature using ethers.js, maps the recovered address to a User record, and issues standard access/refresh JWT tokens
• Redis-backed sliding window rate limiter (10 requests/minute) applied to the nonce endpoint to prevent abuse
• Automatic cleanup of expired nonces to prevent storage bloat

Frontend

• web3.service.ts — manages the full wallet connection lifecycle including provider detection, account access, message signing, and token storage
• Web3Login.tsx — React component with MetaMask detection, connection state, and error handling
• Web3AuthExample.tsx — full-featured integration example page demonstrating the end-to-end authentication flow

Documentation

• WEB3_AUTH_GUIDE.md — complete guide covering API reference, security considerations, integration instructions, and troubleshooting

Reference Issues

Closes #215

Type of Change

• New feature (non-breaking change which adds functionality)

The Web3 auth flow is entirely additive. Existing email/password authentication is unmodified. The new AuthNonce model is a net-new Prisma table with no foreign key impact on existing models.

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

[drips-wave]

@anonfedora Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[ayomideadeniran]

pr under review, if i find any wrong implementation i will notify you.