fix(security): enforce Ed25519 verification and hide escrow_secret (#8179)

[shiyaam-s07]

Fixes #8179

🛡️ Security Vulnerability & Fix Overview

This PR resolves a high-severity security issue where GPU escrow creation endpoints (/render/escrow) accepted arbitrary from_wallet address inputs without validating ownership, while also leaking internal escrow_secret data back in the API payload.

1. Ed25519 Wallet Ownership Verification:

   • Extracted signature and message (nonce/timestamp) parameters from incoming payload requests in node/gpu_render_protocol.py.
   • Integrated cryptographic signature verification using the cryptography library (ed25519.Ed25519PublicKey) to guarantee that the caller strictly controls the corresponding from_wallet public key.
   • Implemented an immediate execution halt returning an HTTP 401 Unauthorized response if signatures are missing, malformed, or mathematically mismatched.

2. Data Leakage Redaction:

   • Stripped escrow_secret from the returned endpoint dictionary payload inside create_escrow, preventing unauthorized exposure of sensitive state secrets in API responses.

---

🧪 Automated Testing & Verification

• Expanded Security Test Cases (tests/test_gpu_render_protocol.py):
  • Valid Ownership Test: Verified that legitimate Ed25519 signed payloads create escrows cleanly.
  • Unauthorized Spoofing Test: Verified that mismatched private key signatures targeting another wallet are rejected with 401.
  • Missing Signature Test: Verified that requests missing cryptographic proof are rejected with 401.
  • Schema Sanitization Test: Asserted that escrow_secret is completely absent from API response outputs.
• Suite Health: Fixed syntax/merge artifacts in node/airdrop_v2.py to achieve a 100% test pass rate across the workspace via pytest.

---

📋 Checklist

• Code follows project formatting and style guidelines.
• Cryptographic verification implemented for all incoming wallet parameters.
• Sensitive fields redacted from API schema.
• Unit/Integration security tests added and passing.

[github-actions]

Welcome to RustChain! Thanks for your first pull request.

Before we review, please make sure:

• Non-doc PRs have a BCOS-L1 or BCOS-L2 label
• Doc-only PRs are exempt from BCOS tier labels when they only touch docs/**, *.md, or common image/PDF files
• New code files include an SPDX license header
• You've tested your changes against the live node

Bounty tiers: Micro (1-10 RTC) | Standard (20-50) | Major (75-100) | Critical (100-150)

A maintainer will review your PR soon. Thanks for contributing!

[shiyaam-s07]

Submitted fix in PR #8183 with Ed25519 signature verification and payload redaction for review!