feat(auth): route all backend-v2 calls through the authed fetch chokepoint (#2879)

[piyalbasu]

TL;DR

Routes every Freighter-extension call to freighter-backend-v2 through a single background "chokepoint" that attaches the user's per-request auth token when the wallet is unlocked, and sends anonymously otherwise (#2879). This is the client groundwork so the backend can attribute requests to a user and, eventually, require authentication.

It's non-breaking: the backend stays permissive, so old clients (and locked/onboarding states) keep working — updated clients just start including the token, which shows up in the backend's auth metrics as adoption signal. No user-facing change.

Invariant: a backend-v2 request carries the per-request JWT only when the wallet is unlocked and goes out anonymously otherwise. The mnemonic / derived auth keypair never leaves the background (only { status, body } returns to the popup) and never appears in a request body or the JWT payload beyond the pubkey sub claim.

Stacked on #2770 (PR #2877) — its base is feat/2770-per-request-backend-jwt, so this diff shows only the #2879 work. Merge order: #2876 → #2877 → this.

Design doc lives in wallet-eng-monorepo (design-docs/contact-lists/Freighter Backend-V2 Authed Fetch Chokepoint Design Doc.md).

Draft for review of the chokepoint architecture + the message-routing of the migrated call sites.

Implementation details (for agents/reviewers)

The chokepoint — extension/src/background/helpers/callBackendV2.ts: derives the auth keypair on-demand from the unlocked session mnemonic (else null → anonymous), and either delegates to authedFetch (#2770, JWT + retry-once-on-401) or does a plain fetch. Returns { status, body }.

• Signed path correctness: INDEXER_V2_URL already includes /api/v1, so the JWT's methodAndPath is derived from the resolved URL's pathname + search (full server request-target incl. query, e.g. POST /api/v1/ledger-key/accounts?network=PUBLIC) — matching the server's r.URL.RequestURI(). Unit-tested by decoding the JWT claim.

Wiring (option A — route through the background): popup callers reach the chokepoint via a new FETCH_BACKEND_V2 message (SERVICE_TYPES + message-request.ts union + a popupMessageListener case gated by isFromExtensionPage so content scripts can't trigger authed calls). The seed never leaves the background; only { status, body } returns to the popup; the base URL is server-fixed (not an open proxy).

Migrated call sites:

• getDiscoverData → GET /protocols (popup → message)
• getLedgerKeyAccounts → POST /ledger-key/accounts?network= (popup → message)
• fetchCollectibles → POST /collectibles?network= (popup → message)
• getTokenPrices (v2 path only) → POST /token-prices?network= (popup → message). The useV2=false path stays a direct fetch to the legacy v1 indexer. This site was added to master by feat(token-prices): migrate getTokenPrices to v2 indexer endpoint #2870 after this branch diverged, so it wasn't in the original migration; routing it fixed a TS2552 (stray INDEXER_V2_URL) and closed the "no call site builds its own fetch to INDEXER_V2_URL" gap.
• rpc-health (account.ts) → GET /rpc-health?network= (background → direct callBackendV2 with skipAuth: true — this endpoint is never auth-gated, so it sends anonymously and skips the keypair/PBKDF2 derivation a JWT would trigger on every health check)

Notable: routing rpc-health introduced a circular import (ducks/session → account.ts → callBackendV2 → helpers/session → store → ducks/session); fixed by lazy-importing callBackendV2 inside getIsRpcHealthy. npx madge --circular confirms zero cycles remain.

Verification: yarn jest @shared/api 76/76; yarn jest extension/src/background 33 suites / 0 failed. New unit tests cover the chokepoint (unlocked/locked, POST body+Content-Type, full signed query path, non-2xx) and each migrated wrapper's message shape + mapping. Reviewed per-task + a whole-branch review (verdict: ready to merge).

Scope / follow-ups (out of scope here):

• Backend permissive→required flip (freighter-backend-v2#114), gated on extension+mobile adoption metrics + a pre-flip audit that none of these endpoints is hit by a locked/watch-only account.
• Mobile parity (freighter-mobile#865).
• Perf: getTokenPrices is the first high-frequency chokepoint caller (the Account view polls it every 30s, uncached), so it now runs deriveAuthKeypair → synchronous PBKDF2 (~18ms block) per poll. Correct but worth a follow-up (short-lived in-background keypair memo, or let the poll honor cache). Tracked separately.
• The two translation.json keys in the diff are the husky i18next-scanner hook backfilling a pre-existing master gap — unrelated.

[github-actions]

PR Preview build is ready: https://github.com/stellar/freighter/releases/tag/untagged-2e703723f10b9da48e1f (SDF collaborators only — install instructions in the release description)