Fix/security and correctness issues

[james2177]

closes #663
closes #664
closes #665
closes #666

FILES CHANGED:

• backend/src/modules/zkp/zkp.service.ts
• backend/src/modules/wallets/wallets.service.ts
• backend/src/modules/prescriptions/prescriptions.controller.ts
• backend/src/modules/prescriptions/prescriptions.service.ts

---

Issue 1 — ZKP hardcoded secret fallback (zkp.service.ts:139)
Removed the ?? 'zkp-dev-secret' fallback. _simulateProof now reads process.env.ZKP_SECRET and throws a descriptive Error if the variable is absent, forcing the app to fail fast at runtime rather than silently using a known-weak secret.

Issue 2 — Wallet network mismatch not validated (wallets.service.ts:201)
Added an explicit guard at the top of prepareTransaction that compares dto.network against wallet.network (stored on the entity). A BadRequestException is thrown with a clear message when they differ, preventing cross-network transaction construction.

Issue 3 — petId not forwarded to expiring-prescriptions query (prescriptions.controller.ts:58-63)
The controller now passes petId as the first argument to getExpiringPrescriptions. The service signature was updated to getExpiringPrescriptions(petId: string, daysWindow = 30) and petId is included in the TypeORM where clause, scoping results to the requested pet.

Issue 4 — Duplicate getRefillReminders (prescriptions.service.ts:267/481)
Inspected the live file — only one implementation exists at line 267 (line 481 is the class closing brace). The single remaining implementation is the complete, correct one that calculates daysUntilRefill per prescription and sorts results. No action needed beyond confirming the duplicate is already gone.

[drips-wave]

@james2177 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits