Authentication

1. Client: POST /api/auth/challenge  { address: "bc1q..." }
2. Server: returns { challengeId, message, expiresAt }
3. Client: signs message with wallet → signature
4. Client: POST /api/auth/verify  { challengeId, address, signature, publicKey }
5. Server: verifies signature → returns { token, user }

{
  "error": "Address not whitelisted for beta access",
  "message": "This address has not been approved for the beta. Contact the admin to request access."
}

Authorization: Bearer <token>

{
  "address": "bc1q..."
}

{
  "challengeId": "uuid",
  "message": "Sign in to OrdsBot: <nonce>",
  "expiresAt": 1700000000
}

{
  "challengeId": "uuid",
  "address": "bc1q...",
  "signature": "base64...",
  "publicKey": "02abc..."
}

{
  "token": "session_token",
  "user": {
    "id": 1,
    "address": "bc1q...",
    "plan": "beta",
    "isAdmin": false
  }
}

{
  "id": 1,
  "address": "bc1q...",
  "ordinalsAddress": "bc1p...",
  "plan": "beta",
  "planDetails": {
    "name": "Beta Tester",
    "maxTasks": 100,
    "maxBidsPerTask": 10,
    "priceSats": 0,
    "durationDays": 90
  },
  "stats": {
    "taskCount": 3,
    "maxTasks": 100,
    "exposure": 1200000,
    "maxExposure": 5000000
  }
}