Wallet private key sent in plaintext on /api/setup/wallet/import endpoint

[ether-btc]

The import wallet endpoint accepts the private key in plaintext in the request body. While localhost-only today, the UI displays no warning about this, and combined with the server binding to all interfaces (see related issue), the key becomes network-visible.

Severity: High

Fix: Add UI warning that private key is stored locally. Combine with binding to 127.0.0.1 only.

[yanj920922-dot]

🔒 Security Fix: Wallet Private Key Encryption

Issue: Private key transmitted in plaintext on /api/setup/wallet/import.

Fix: Added AES-256-GCM encryption at the API boundary.

• Key encrypted client-side before transmission
• Decrypted server-side upon receipt
• Session-derived encryption key (no static key storage)
• Zero external dependencies (Node.js built-in crypto only)

Reference implementation: yanj920922-dot/cashclaw-security-fix

Files affected: src/lib/crypto.ts (new), src/ui/lib/api.ts (modified), src/agent.ts (modified)