feat: gate read endpoints + e2e

[sadiq1971]

3 of 3 — read-API authentication (closes #341). Base: feat/auth-service.

Wires the auth service into the api-server and gates the read path.

• server.go — buildReadAuth (optional: passthrough when no auth config); mount /auth/login, /auth/nonce, /.well-known/jwks.json; pass the read-auth middleware to the route registrars
• transfer read endpoints + /profile — resolve the caller from the bearer token when auth is on, else fall back to ?address=
• user service — /profile gating; GetUser no longer takes msg/sig
• docker-compose + Makefile — provide JWT_PRIVATE_KEY (base64 RSA PEM)
• e2e — APIServerShim performs a real SIWE login and attaches the JWT to the transfer read calls

Why no refresh token: short-lived access tokens with no refresh token are the simplest secure-revocation story — nothing long-lived to steal or to build rotation/reuse-detection around, and a leaked JWT is useless after token_ttl. On expiry the client re-runs SIWE login (silent for custodial, one wallet prompt for non-custodial). token_ttl is the knob to widen first if needed; a refresh token can be added later without changing this design.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 38.88889% with 44 lines in your changes missing coverage. Please review.
✅ Project coverage is 33.70%. Comparing base (77ee61c) to head (a6dc3e7).

Files with missing lines	Patch %	Lines
pkg/app/api/server.go	0.00%	34 Missing ⚠️
pkg/transfer/http.go	66.66%	8 Missing ⚠️
pkg/user/service/log.go	0.00%	2 Missing ⚠️

❌ Your patch status has failed because the patch coverage (38.88%) is below the target coverage (50.00%). You can increase the patch coverage or adjust the target coverage.

Additional details and impacted files

@@                  Coverage Diff                  @@
##           feat/auth-service     #354      +/-   ##
=====================================================
+ Coverage              33.52%   33.70%   +0.17%     
=====================================================
  Files                    163      163              
  Lines                  12512    12532      +20     
=====================================================
+ Hits                    4195     4224      +29     
+ Misses                  7981     7968      -13     
- Partials                 336      340       +4     

Flag	Coverage Δ
unittests	33.70% <38.88%> (+0.17%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
pkg/user/service/http.go	57.89% <100.00%> (+0.56%)	⬆️
pkg/user/service/service.go	20.49% <100.00%> (-2.83%)	⬇️
pkg/user/service/log.go	0.00% <0.00%> (ø)
pkg/transfer/http.go	15.08% <66.66%> (+15.08%)	⬆️
pkg/app/api/server.go	0.00% <0.00%> (ø)

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[gemini-code-assist]

Code Review

This pull request implements read-endpoint authentication using SIWE (Sign-In with Ethereum) and JWT bearer tokens, updating the /profile and transfer read endpoints to resolve the caller's address from the authenticated context (falling back to the ?address= query parameter if authentication is disabled). Feedback focuses on ensuring that EVM addresses retrieved from the authenticated context are normalized to lowercase at the HTTP handler level in both pkg/transfer/http.go and pkg/user/service/http.go to prevent potential database query mismatches.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[sadiq1971]

Addressed Gemini's review in 2e9bbbb:

• transfer/http.go (normalize context address, high): callerAddress now normalizes the address from the token context too (the transfer service looks the address up verbatim and does not normalize), so both the token and ?address= branches yield a canonical address.
• user/service/http.go (normalize in /profile, medium): same normalization applied at the handler for consistency, independent of the service-layer normalization.
• Updated two /profile handler tests to use a normalized address accordingly.