[flare-999]

Summary
This change adds wallet-scoped nonce tracking to ensure actions can only be executed once per nonce value and that the current nonce state is auditable.

It introduces a nonce getter and a consume path that validates and increments the nonce atomically, preventing replay attacks and preserving proper audit data in action execution events.

Scope

• get_nonce(wallet) — returns current nonce for wallet
• consume_nonce(wallet, nonce) — validates and increments nonce, called by action handlers
• Nonce invalidated immediately on consumption
• Replay attempt returns NonceAlreadyUsed error
• Nonce emitted in ActionExecuted events for auditability

Changes

• Add wallet-specific nonce retrieval via get_nonce(wallet)
• Add consume_nonce(wallet, nonce) to validate the provided nonce and increment the stored value
• Immediately invalidate a nonce after successful consumption
• Return NonceAlreadyUsed when a replayed nonce is attempted
• Include the nonce in ActionExecuted event payloads for auditability
• Ensure concurrent nonce consumption is safe and race-free

Acceptance Criteria

• get_nonce returns correct current nonce per wallet
• consume_nonce increments correctly after use
• Replay of consumed nonce returns NonceAlreadyUsed error
• Nonce included correctly in ActionExecuted events
• Concurrent nonce consumption handled without race condition

Testing

• Unit tests for nonce retrieval and increment behavior
• Replay protection regression tests
• Event payload validation for ActionExecuted
• Concurrency test covering simultaneous valid consumption attempts
  closes Add session nonce contract for replay attack prevention on signed actions #1036

[Chucks1093]

🚨 Automated Security Alert

This PR has been automatically closed by the PR monitor because it contains code patterns associated with the PolinRider malware campaign.

Detected indicators may include:

• Obfuscated payloads hidden after long whitespace in config files
• eval() or spawn() calls in config files
• VS Code auto-task on folder open (runOn: folderOpen)
• Suspicious font files or dist/setup.js loader
• Known PolinRider marker strings

Please do not reopen this PR or run the code locally. If you believe this is a false positive, contact a maintainer directly.