feat: auth SIWE login service + config

[sadiq1971]

2 of 3 — read-API authentication. Base: feat/auth-jwt.

The orchestration layer over pkg/auth/jwt, plus the config type. Not wired into the server yet (inert until PR 3), so it's reviewable as pure business logic.

• pkg/auth/service — login flow (nonce → SIWE verify → issue JWT), HTTP handlers, log decorator, consumer interfaces (Verifier/Issuer/NonceStore/UserLookup) + mockery mocks
• pkg/auth/service/nonce_provider — address-keyed in-memory nonce store (reuse per address; reject-when-full, never evicts a live nonce)
• pkg/auth/config.go, pkg/auth/types.go — Config + wire DTOs
• pkg/config — add optional auth block; remove the dead JWKS type/field (and its jwks: blocks from the default configs)

[codecov-commenter]

Codecov Report

❌ Patch coverage is 75.73529% with 33 lines in your changes missing coverage. Please review.
✅ Project coverage is 33.52%. Comparing base (9fa7b9c) to head (77ee61c).

Files with missing lines	Patch %	Lines
pkg/auth/service/log.go	0.00%	28 Missing ⚠️
pkg/auth/service/http.go	92.50%	2 Missing and 1 partial ⚠️
pkg/auth/service/nonce_provider/in_memory.go	95.23%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@                Coverage Diff                @@
##           feat/auth-jwt     #353      +/-   ##
=================================================
+ Coverage          33.08%   33.52%   +0.44%     
=================================================
  Files                159      163       +4     
  Lines              12376    12512     +136     
=================================================
+ Hits                4094     4195     +101     
- Misses              7949     7981      +32     
- Partials             333      336       +3     

Flag	Coverage Δ
unittests	33.52% <75.73%> (+0.44%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
pkg/auth/service/login.go	100.00% <100.00%> (ø)
pkg/config/config.go	71.18% <ø> (ø)
pkg/auth/service/nonce_provider/in_memory.go	95.23% <95.23%> (ø)
pkg/auth/service/http.go	92.50% <92.50%> (ø)
pkg/auth/service/log.go	0.00% <0.00%> (ø)

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[gemini-code-assist]

Code Review

This pull request introduces a new authentication service (pkg/auth) implementing Sign-In with Ethereum (SIWE) login, nonce management, and JWKS token validation, replacing the previous basic JWKS configuration. Feedback on these changes highlights a potential nil pointer dereference on resp in the login logging decorator when ls.svc.Login returns a nil response with a nil error. Additionally, a slight inconsistency in expiration logic was identified in the in-memory nonce provider, where purgeExpired uses now.After(e.expiry) while Issue and Consume check now.Before(e.expiry).

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[sadiq1971]

Addressed Gemini's review in c8d567f:

• log.go (nil response, medium): the Login log decorator now builds its fields conditionally and only reads resp.ExpiresAt when resp != nil — no panic if an implementation returns (nil, nil).
• in_memory.go (expiry boundary, medium): purgeExpired now uses !now.Before(e.expiry), matching the liveness check in Issue/Consume (an entry at exactly its expiry instant is treated as expired everywhere).