refactor(server): separate challenge exact-timestamp and skew checks

The previous condition conflated three distinct failures under one
"challenge timestamp mismatch" message. Split it into:
1) message timestamp != challenge create timestamp, and
2) valid exact match but outside allowed skew.
Both still map to HTTP 400. Copilot review on #402.

Author: Ryanmello07

model/wallet_auth_challenge_model.go

@@ -271,12 +271,17 @@ func UseWalletAuthChallenge(
 			return
 		}
 
-		if messageTime.Before(createTime.Add(-WalletAuthChallengeSkewPast)) ||
-			messageTime.After(createTime.Add(WalletAuthChallengeSkewFuture)) ||
-			messageTime.Unix() != createTime.Unix() {
+		// The message must be the exact one issued for this challenge.
+		if messageTime.Unix() != createTime.Unix() {
 			err = errors.New("challenge timestamp mismatch")
 			return
 		}
+		// Then allow small clock skew relative to challenge creation time.
+		if messageTime.Before(createTime.Add(-WalletAuthChallengeSkewPast)) ||
+			messageTime.After(createTime.Add(WalletAuthChallengeSkewFuture)) {
+			err = errors.New("challenge timestamp outside allowed skew")
+			return
+		}
 
 		if used {
 			err = errors.New("challenge already used")
@@ -308,7 +313,7 @@ func UseWalletAuthChallenge(
 		switch err.Error() {
 		case "challenge already used", "challenge expired":
 			code = "403"
-		case "challenge timestamp mismatch":
+		case "challenge timestamp mismatch", "challenge timestamp outside allowed skew":
 			code = "400"
 		}
 		return &UseWalletAuthChallengeResult{