fix(sdk): align auth endpoints with real SEP-10 routes + implement initSdkAuth

[waterWang]

Summary

Fixes #899 — the SDK's auth helpers were calling non-existent endpoints (POST /api/auth/challenge, POST /api/auth/verify) which returned 404, and initSdkAuth() was an empty stub, so the SDK could never authenticate against the real SEP-10 backend.

Changes

frontend/lib/sdk-instance.ts

• getChallenge(publicKey) → now calls GET ${baseUrl}/api/auth?account=${publicKey} (matches the backend route in backend/src/routes/auth.js), with the public key URL-encoded. No request body.
• verifyChallenge(signedXDR) → now calls POST ${baseUrl}/api/auth with body { "transaction": signedXDR } (matches the backend verify route).
• initSdkAuth() → now loads the access token from getJwtToken() (the existing auth storage) and attaches it to the SDK instance via sdk.setToken(token).
• Fixed the module import to also bring in apiFetch (it was referenced but not imported).

frontend/__tests__/sdk-instance.test.ts (new)

• 5 tests: challenge URL/method, URL-encoding of the account, verify endpoint/body, token attachment via initSdkAuth, and no-token no-op behavior.

Acceptance criteria

• SDK auth calls hit the real endpoints with correct methods
• initSdkAuth actually attaches a token
• ≥4 tests; mock-fetch approach matching the repo's existing test style

Wallet address (GrantFox FWC26 — no specific token, not appended)

[github-actions]

🤖 Greptile AI Code Review

Greptile will automatically review this PR (2 file(s) changed).

Review gates:

• ✅ CodeQL Security Scan
• ✅ Custom rules (.greptile/config.json)
• ✅ Architecture guidelines (.greptile/rules.md)

To manually trigger a re-review, comment @greptileai on this PR.
To skip review, add the skip-review label.