feat: wallet security best practices and warnings (#890)

[adenueltech]

Closes #890

What changed

Show security tips on login

• WalletSecurityCenter (mounted once in the root layout) shows a "Keep your wallet safe" dialog the first time a wallet connects in a browser session. The tips cover never sharing secret keys, using an encrypted wallet, reading transactions before signing, checking the network, and locking when away. It includes a "Don't show these tips again" option and a link to security settings.

Warn about unencrypted wallets / key exposure

• If a valid Stellar secret seed (S…, checksum-verified) or a 12–24 word recovery phrase is typed or pasted into any field, a blocking warning explains that StellarSplit never needs it and tells the user to move their funds if it was shared. Password fields are ignored, and nothing is stored: detection only classifies the text.
• A banner warns when the page isn't served over an encrypted connection (!isSecureContext; localhost is fine).

Session timeout

• Builds on the existing SessionLockProvider and keeps its API, so the existing tests still pass:
  • A 60-second countdown warning with a "Stay signed in" button before locking.
  • Locking clears the cached wallet session (sessionStorage.stellarsplit_wallet), so a reload requires a fresh connect.
  • Clicks behind the lock screen no longer extend the session.
  • The timeout (5/15/30/60 min/never) can now be set in Settings → Security. Before, nothing in the UI called setTimeoutMinutes.

Biometric authentication (optional)

• src/lib/biometric.ts uses WebAuthn with a user-verifying platform authenticator (Touch ID, Face ID, Windows Hello, Android fingerprint). Users can enable it in Settings → Security. When enabled, a locked session needs a biometric check to unlock, or the user can disconnect. The toggle is disabled when the device has no supported sensor.
• This is a local presence check. It doesn't replace wallet signatures, and nothing is sent to a server.

Suspicious activity

• A small local security log (recordSecurityEvent) captures failed connections, rejected or failed signatures, account switches, secret-key entry, rate-limit hits and session locks.
• detectWalletAnomalies flags patterns in the last 10 minutes, such as 3+ failed connects, 3+ rejected signatures, repeated account switching, or any secret-key exposure. These show as dismissible alerts linking to settings. The settings page lists recent security activity, with a Clear button.

Rate limiting

• Sliding-window limiter on wallet connections (5/min per wallet type) and transaction signing (10/min). Blocked attempts throw RateLimitError with a "wait Ns" message and are logged as suspicious activity.

How I tested

• src/__tests__/walletSecurity.test.ts: tips, secret seed and recovery phrase detection (including look-alikes and normal sentences), encrypted-connection check, rate limiter (window sliding, per-key, error), event log (cap of 100, corrupt storage) and every anomaly rule.
• src/__tests__/SessionLock.test.tsx: all existing tests still pass, plus new tests for the countdown warning, clearing the wallet session on lock, and biometric unlock when enabled.
• All 15 existing test files that touch the wallet hook, Freighter helpers, wallet connect, session lock or layout: 228/228 passing.
• npx tsc --noEmit: 0 errors. next lint on changed files: clean.

🤖 Generated with Claude Code

[vercel]

@adenueltech is attempting to deploy a commit to the kingsman-99's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@adenueltech Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits