feat: add SEP-0043 signature verification for browser wallets

[EmeditWeb]

Problem

The auth/verify endpoint only accepts raw Ed25519
signatures. The Freighter browser extension signs using
SEP-0043, which adds a prefix to the message before
signing. So browser-based apps can't authenticate with
StepFi without the mobile app.

Context

SEP-0043 is the Stellar standard for browser wallet
signing. Supporting it makes StepFi-Web work for
Freighter and Rabet users.

Before Starting

Read these context files:

• context/architecture-context.md
• context/code-standards.md
• src/modules/auth/auth.service.ts
• src/modules/auth/dto/verify-request.dto.ts

What To Build

Update auth.service.ts verify() method to:

1. Try raw Ed25519 verification first (mobile)
2. If that fails, try SEP-0043 verification (browser)
3. Return JWT if either succeeds

Add signatureType field to VerifyRequestDto:
signatureType: 'raw' | 'sep0043' (optional, defaults to raw)

SEP-0043 prefix: the message signed is:
'Stellar Signing Key: ' + nonce

Files To Touch

• src/modules/auth/auth.service.ts
• src/modules/auth/dto/verify-request.dto.ts

Acceptance Criteria

• Raw Ed25519 signatures still work (mobile)
• SEP-0043 signatures work (browser/Freighter)
• Both return same JWT structure
• Unit tests cover both signature types
• npm run build passes

Mandatory Checks Before PR

• npm run build passes with zero TypeScript errors
• No any types
• Unit tests added for both paths
• PR references this issue

[Swayymalcolm99]

Hello maintainer, can I take this one please?

[Godfrey-Delight]

Hey Maintainer
Let me take this off your plate ASAP

[grantfox-oss]

🦊 GrantFox — @Godfrey-Delight has been assigned to this issue as part of the Official Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #19)
2. Your PR will be reviewed by the StepFi-app maintainers

Good luck! Track your progress on GrantFox.

[EmeditWeb]

Please read through the context files

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox as part of the Official Campaign campaign!

@Godfrey-Delight's PR #44 was approved and merged by @EmeditWeb.

🏆 @Godfrey-Delight: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (48 total points). Track your full progress on GrantFox.

👏 Great work, @Godfrey-Delight! Keep contributing to StepFi-app.