Harden node boundary, wallet key storage, and CI

[the-code-learner]

Scope

This hardening pass aligns the current Phase 1 implementation with Zephyr's user-first, open, production-oriented mission without pretending the network is production-ready.

Process and HTTP boundary

• expose the process through a hardened PublicHandler
• keep /v1/dev/* disabled unless ZEPHYR_ENABLE_DEV_ENDPOINTS=true
• bind to 127.0.0.1:8080 by default and require explicit configuration for wider exposure
• add HTTP read/write/header/idle limits, request-body limits, graceful shutdown, and defensive header sizing
• require peer-origin context for /v1/internal/snapshot and sign internal snapshot GET requests through the validator identity path

Wallet custody and browser integration

• replace plaintext private-key persistence with PBKDF2-SHA-256 + AES-256-GCM encrypted local storage/backups
• validate address, SPKI, public JWK, and private JWK consistency before signing
• support one-time migration of legacy plaintext wallet backups into encrypted storage
• add explicit create/unlock/import/passphrase UX
• use same-origin API access by default, with a Vite development proxy to the local node
• upgrade the Vite toolchain and remediate high-severity npm audit findings

State, consensus, and arithmetic hardening

• persist state.json atomically through temp-file write, fsync, rename, and owner-only permissions
• protect node data directories/state files with restrictive permissions
• reject DPoS delegated, per-validator, and aggregate voting-power overflow
• add checked ledger balance/nonce/voting-power arithmetic and an overflow-safe quorum calculation
• reject receiver balance overflow during block production/import
• prevent unsigned remote proposal/vote timestamps from controlling the local consensus round timer
• stabilize asynchronous consensus recovery tests by giving the existing network simulation realistic deadline slack

Engineering hygiene

• add permanent CI for changed-file Go formatting, go vet ./..., go test ./..., npm audit, wallet type-check, and wallet build
• add weekly Dependabot coverage for Go modules and npm
• add SECURITY.md and update README/quick-start for secure defaults

Protocol blockers tracked separately

These require protocol/genesis/network decisions and should not be silently introduced as compatibility-breaking changes in this foundation PR:

• Add chain ID and domain separation to all signed protocol messages #2 chain ID and versioned signing-domain separation
• Canonicalize P-256 signatures and transaction identity #3 canonical P-256 signatures and deterministic transaction identity
• Make peer authentication replay-safe and bind identity to requests #4 replay-safe request-bound peer authentication
• Authenticate and fully validate peer snapshots before state restore #5 authenticated and fully validated state snapshots before restore

Verification

• ledger-focused hardening jobs passed before their commits
• the normal CI workflow covers the complete Go suite and wallet audit/type-check/build on every PR head

Important

Zephyr remains pre-production. This PR hardens the existing HTTP/devnet architecture; it does not claim production finality, libp2p networking, WASM execution, governance-driven staking, confidential compute, or 1M TPS readiness. The throughput target remains something to prove with repeatable benchmarks and adversarial multi-node testing.