fix(users): isolate profiles with device credentials

[0xApotheosis]

Description

Wallet addresses could retrieve another device's profile. Uses device-key authentication, session-scoped operations and one-use push delivery proofs. Internal administration requires the service key.

Apply shared auth/quota migrations once and test/release with microservices #69, web #12742 and mobile #165/#166.

Verification

Use two browser profiles with the same wallet: expect separate IDs, persistence on reload and no login signature. A's token must not access B; anonymous internal routes should return 401. Across two replicas, redeem one challenge concurrently: only one session may be issued. Reject wrong/expired/replayed push proofs and verify real-device registration.

Mocked checks passed; database and device QA remain outstanding.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}