[ValJnr-dev1]

Closes #1317

Summary

Implements wallet-based sign-in via Freighter and a single authenticated fetch helper (authFetch) so the rest of the app has a standard way to call requireAuth endpoints.

Changes

File	What changed
src/services/authService.ts	New service: signIn(), signOut(), getAccessToken(), refreshAccessToken()
src/services/authFetch.ts	New helper: authFetch(path, init) with single-flight refresh
src/App.tsx	WalletSignInButton added to topbar; AppSessionExpiryBanner wired
src/pages/ApiUsage.tsx	Usage fetch migrated from plain fetch() to authFetch()
docs/Configuration.md	New §\ Session model — token storage trade-offs, httpOnly upgrade path
src/services/authService.test.ts	25 tests (all 9 issue scenarios)
src/services/authFetch.test.ts	14 tests

Sign-in sequence

Browser                   Freighter            Callora API
  |                          |                     |
  | requestAccess()          |                     |
  |------------------------->|                     |
  |<---- address ------------|                     |
  |                          |                     |
  | signMessage(challenge)   |                     |
  |   • app origin           |                     |
  |   • wallet address       |                     |
  |   • ISO timestamp        |                     |
  |   • expiry +5 min        |                     |
  |   • 128-bit nonce        |                     |
  |------------------------->|                     |
  |<---- signedMessage -------|                     |
  |                          |                     |
  | POST /api/auth/wallet    |                     |
  |-------------------------------------------->  |
  |<-- { accessToken, refreshToken } --------------|
  |                          |                     |
  | access token → memory    |                     |
  | refresh token → sessionStorage                 |

Refresh and expiry

On a 401, authFetch calls refreshAccessToken(). Concurrent 401s share a single refresh promise (no stampede). If the refresh also fails, signOut() clears local state and signalExpiry() fires so SessionExpiryBanner appears. An AbortSignal from the caller is forwarded to both the initial request and the retry.

Token storage

• Access token — module-level variable, never persisted.
• Refresh token — sessionStorage, cleared when the tab closes.
• localStorage is never written to (verified by test Scenario 8).

The docs section explains the trade-off and the path to upgrade to httpOnly cookies once the backend adds Set-Cookie.

Test output

Test Files  146 passed (146)
     Tests  2226 passed (2226)

Coverage for new services:

• authService.ts: 93.57% stmts / 83.56% branches / 100% funcs
• authFetch.ts: 94.79% stmts / 92.30% branches / 83.33% funcs

[drips-wave]

@ValJnr-dev1 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits