fix(auth): derive client state from wallet connection

[nasalehj]

Summary

Closes #815

The client auth hook now derives authentication from the canonical wallet store after client hydration instead of treating an auth-token cookie as proof of identity. It returns the connected wallet address, never the 0x... placeholder, and preserves the session fields consumed by AuthGuard.

Why

The previous hook trusted cookie presence or an unverified JWT payload, so expired, malformed, and forged cookies could render authenticated UI. It also fabricated the wallet address. Browser code cannot verify the server-signed JWT without exposing the secret, so the existing connected-wallet state is used as the client UI source of truth while server middleware remains responsible for cookie verification.

What was built

File	What it contains
src/hooks/useAuth.ts	Hydration-aware auth state derived from src/store/walletStore; connected wallet address is returned only when isConnected and address are both present.
src/hooks/__tests__/useAuth.test.ts	Five focused tests for no cookie, cookie-only, malformed/expired payload, connected wallet, and disconnected wallet with an address.
useAuth.ts	Compatibility re-export to the live hook so the orphan duplicate cannot retain a competing cookie-based implementation.

The focused tests mock the canonical wallet store and use a real hook render; no cookie parsing or JWT client verification path remains in the implementation.

Integration changes outside src/hooks/

• useAuth.ts — reduced to a compatibility re-export of src/hooks/useAuth.ts so duplicate implementations cannot diverge.

Acceptance criteria coverage

• useAuth no longer treats document.cookie.includes('auth-token=') as authentication; an expired/invalid/forged token results in isAuthenticated: false. (src/hooks/useAuth.ts, src/hooks/__tests__/useAuth.test.ts — cookie-only and malformed/expired payload tests pass)
• userAddress is never the literal '0x...' placeholder; it comes from the wallet provider or a verified session, or is null when unknown. (src/hooks/useAuth.ts, src/hooks/__tests__/useAuth.test.ts — connected address and null/disconnected assertions)
• The "Mocking check" comment is gone. (src/hooks/useAuth.ts, useAuth.ts — duplicate mock implementation removed)
• Tests cover: no cookie -> unauthenticated; cookie present but unverified/expired -> unauthenticated; verified session or connected wallet -> authenticated with the real address. (src/hooks/__tests__/useAuth.test.ts — 5/5 passing)
• npm run typecheck, npm test, and npm run lint pass. — Repository-wide gates remain blocked by pre-existing syntax errors, unrelated test failures, and missing eslint-plugin-jsdoc; the issue-specific suite passes.

Deliberately deferred

• Backend session verification — explicitly out of scope; no client-side secret exposure or backend API redesign was introduced.

Test plan

• npx prettier --check src/hooks/useAuth.ts src/hooks/__tests__/useAuth.test.ts useAuth.ts — all matched files pass.
• npm test -- --runInBand src/hooks/__tests__/useAuth.test.ts — 5/5 passing.
• npm run typecheck — fails on pre-existing syntax errors in unrelated files including src/app/compare/page.tsx, src/components/ComparisonBar.tsx, src/components/PropertyCard.tsx, src/components/TransactionConfirmation.tsx, src/lib/toast.ts, and src/stories/ResponsiveContainerExample.stories.ts; the baseline also reports an existing src/components/CartSidebar.tsx syntax error.
• npm test -- --runInBand — 63/141 suites passing; 982/1149 tests passing. Failures are existing repository issues including incomplete viem mocks, malformed unrelated source/tests, and unrelated component assertions.
• npx eslint src/hooks/useAuth.ts src/hooks/__tests__/useAuth.test.ts useAuth.ts --max-warnings=0 — cannot start because eslint-plugin-jsdoc is not installed.
• npm run build — stops at the same pre-existing typecheck failures.

Env vars / Notes

No new environment variables, migrations, or API changes.

[drips-wave]

@nasalehj Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits