feat(auth): server-issued wallet auth challenge

[Ryanmello07]

Summary

Replace client-generated wallet login messages with a server-issued, single-use, expiring challenge to prevent replay attacks.

What's new

• New wallet_auth_challenge table + index.
• POST /auth/wallet-challenge endpoint returns { challenge, timestamp, expires_in, message_template }.
• UseWalletAuthChallenge verifies:
  • Signature is valid for the wallet.
  • Challenge exists and has not been used.
  • Challenge has not expired.
  • Timestamp is within an acceptable clock-skew window (past + future).
• Wallet login (/auth/login) and wallet network create (/auth/network-create) now require a valid challenge.
• Dashboard PR: https://github.com/Ryanmello07/urnetwork-webmanager/pull/new/feat/wallet-auth-challenge

Security properties

• Each signature is bound to a unique challenge value and timestamp generated by the server.
• One challenge = one use. Replaying a spent signature fails immediately.
• Challenges expire after 5 minutes and timestamps outside ±5-minute skew are rejected.

Review notes

• Go runtime tests require the project test DB env (WARP_ENV / pg.yml) which is not available in this container; go build ./... and go vet ./model/... pass locally.
• Coordinated merge with the dashboard PR is needed; older clients that don't request challenges will no longer be able to log in with a wallet.