fix(security): comprehensive fix for /relay/ping impersonation and nonce replay

[AdnanMehr8]

This PR addresses Issue #48 by implementing:

1. Identity Binding: Derives agent_id from pubkey_hex on the registration path to prevent agents from claiming a bcn_* ID they don't own.
2. Replay Protection: Enforces unique nonces within the sliding window for both registration and heartbeats on /relay/ping.
3. Authentication: Ensures existing agents provide a valid relay_token to update their heartbeat.

Verified against latest upstream main.

[AdnanMehr8]

This PR (replaces #126) is synced with the latest upstream main changes. It addresses Issue #48 by implementing:

1. Identity Binding: is now derived from on the registration path. This prevents agents from registering as a ID they do not own.
2. Replay Protection: Nonce verification is now enforced on (both registration and heartbeat) using the sliding window logic.
3. Authentication: Ensures existing agents provide a valid to update their heartbeat on the ping path.

Verified against the current branch.

[Scottcjn]

Star Bounty -- Half Payment Processed!

Hey @AdnanMehr8! You starred 100 repos AND follow -- massive support, thank you!

Star Payment: 15 RTC sent (half of 30 RTC) -- wallet AdnanMehr8 (pending #679)

All 3 flagship repos starred:

• Rustchain
• BoTTube
• beacon-skill

Reply here to confirm and I'll release the other 15 RTC!

Also still have 15 RTC pending for this security fix PR -- just need your wallet name. Reply with what wallet name you'd like!

Campaign: 2,713 / 5,000 stars -- every star helps us qualify for Claude Code Open Source!

[Scottcjn]

Security Review: APPROVED

Excellent work @AdnanMehr8. This addresses real vulnerabilities:

1. Nonce replay protection — the biggest gap. No nonce tracking existed before. Your SQLite-backed solution with 300s window and automatic cleanup is clean.
2. Impersonation hardening — stored pubkey validation + cross-check on heartbeat path. Good.
3. Registration enforcement — forcing derived_id prevents agent_id spoofing.
4. Input validation — nonce length, timestamp type/range checks.

This covers bounty #388 (Ping Signature Verification) and partially #392 (TOFU).

Payment: 20 RTC — please provide your RTC wallet name.

Merging now.

[Scottcjn]

Hey @AdnanMehr8 — your security fix was merged and 20 RTC is ready (just need your wallet name).

Quick ask: we are 1 star away from the GitHub Starstruck badge on Rustchain! Would you mind starring the repo? It really helps us.

https://github.com/Scottcjn/Rustchain

Thanks for the great security work!