Feat/multi 681 675 676 677

[sweetsoul21]

Summary of Changes

This unified PR implements security hardening, distributed reliability, performance configurability, and standardized error responses across the Parashield backend:

1. Issue [bug] AuthService wallet signature verification does not enforce nonce freshness #681 — Wallet Nonce Freshness & Single-Use Security:

   • Enforced single-use, time-bound nonces in Redis for wallet authentication challenges.
   • Bound nonces strictly to target wallet addresses (auth:nonce:<walletAddress>).
   • Nonce consumed atomically (GETDEL / Lua script fallback) prior to cryptographic signature verification to prevent replay attacks and race conditions.
   • All invalid, expired, reused, or address-mismatched nonces return a generic 401 response without disclosing verification failure reasons.
   • Added comprehensive unit tests covering single-use replay protection, TTL expiry, address mismatch, concurrent double-submits, and failed signature nonce consumption.

2. Issue [bug] Scheduled jobs do not handle distributed lock contention #675 — Distributed Locking for Scheduled Jobs:

   • Implemented a reusable, zero-external-dependency distributed lock helper on RedisService (SET key token NX PX ttl).
   • Safe release using an atomic compare-and-delete Lua script preventing stale holders from releasing newer acquisitions.
   • Configurable watchdog renewal loop periodically extending the lock for long-running batch jobs.
   • Wrapped all scheduled workers (AuthCleanupWorker, OracleWorker, ClaimsWorker) with stable per-job keys and configurable TTLs.
   • Fail-safe Redis-down behavior: skips execution and logs errors loudly to prevent catastrophic duplicate transactions or payouts.
   • Added unit tests covering mutual exclusion, skip-on-lock, success/failure release, TTL auto-expiry, stale-release protection, and watchdog heartbeats.

3. Issue [perf] Database connection pool not sized for production load #676 — Database Connection Pool Sizing & Monitoring:

   • Made Prisma connection pool limits, pool timeouts, and connect timeouts fully configurable via environment variables (DATABASE_CONNECTION_LIMIT, DATABASE_POOL_TIMEOUT, DATABASE_CONNECT_TIMEOUT).
   • Implemented strict startup validation and precedence preservation for explicit DATABASE_URL query parameters.
   • Added effective pool configuration logging at startup and exposed genuine pool metrics through the /api/v1/health endpoint.
   • Documented pool sizing guidance and provided a k6 connection pool stress test script (loadtest/k6/pool-stress.js).

4. Issue [a11y] API error response codes do not follow RFC 7807 problem detail format #677 — RFC 7807 Problem Details for API Errors:

   • Standardized all application error responses to return Content-Type: application/problem+json with members type, title, status, detail, and instance.
   • Included extension members errors for validation failure arrays and correlationId from request headers.
   • Sanitized 500 internal errors to prevent leaking stack traces, SQL syntax, or internal secrets.
   • Full backward compatibility: retained deprecated legacy fields (success: false, statusCode, error, message, errorCode, path, timestamp) in the response body.
   • Updated OpenAPI/Swagger specifications and README documentation.

Closes #681
Closes #675
Closes #676
Closes #677

[drips-wave]

@sweetsoul21 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits