fix(security): eliminate dynamic property injection

[ty-everett]

Summary

• replace request- and peer-keyed plain objects in the auth transport with Map storage
• define decoded and normalized wallet values as own data properties so reserved keys cannot invoke prototype setters
• cover hostile __proto__ identifiers and payload keys, completed-handle cleanup, certificate success/failure/listener/timeout cleanup, and missing general handles

This is the dynamic-property-injection security wave tracked by #324. It does not alter CORS, CSP, public-service accessibility, authentication semantics, or package versions.

Validation

• auth-express-middleware: 3 suites, 29 tests passed
• wallet-toolbox: 141 suites, 1,277 tests passed; 5 suites and 27 tests intentionally skipped
• focused wallet remoting tests: 2 suites, 42 tests passed
• both affected packages build successfully
• both affected packages lint with no errors (pre-existing warnings remain)
• root audit: 0 vulnerabilities
• health controls: 37 projects, 0 errors
• SDK peer contract: 33 package manifests, 0 violations
• version synchronization and diff checks pass
• extended CodeQL passed after replacing per-key writes with prototype-safe batched descriptors
• Sonar new-code issue count returned to zero after decoder complexity refactoring

Release planning

No package versions are changed or published in this PR. Current final-program candidates are:

• @bsv/auth-express-middleware: 2.2.0 (public transport field types are hardened from records to maps)
• @bsv/wallet-toolbox: 2.4.5

[codecov]

Codecov Report

❌ Patch coverage is 91.07143% with 5 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...es/middleware/auth-express-middleware/src/index.ts	85.29%	1 Missing and 4 partials ⚠️

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud