Auth Duniter v2 : vérification réelle + extension signing + titres outils

Backend :
- Vérification Sr25519/Ed25519 réelle via substrateinterface (bypass démo)
- Message signé : <Bytes>{challenge}</Bytes> (convention polkadot.js)
- DEV_PROFILES : Charlie → Référent structure, Dave → Auteur (WoT member)

Frontend :
- Signing via extension polkadot.js / Cesium2 (_signWithExtension)
- @polkadot/extension-dapp + @polkadot/util installés
- Vite : global=globalThis + optimizeDeps pour les packages polkadot
- Boîte à outils : titres complets des 4 sections

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/app/stores/auth.ts

@@ -5,6 +5,40 @@
  * The identity object mirrors the backend IdentityOut schema.
  */
 
+/**
+ * Sign a challenge using the injected Duniter/Substrate wallet extension
+ * (Cesium2, polkadot.js extension, Talisman, etc.).
+ *
+ * The extension signs <Bytes>{challenge}</Bytes> to match the backend verifier.
+ */
+async function _signWithExtension(address: string, challenge: string): Promise<string> {
+  const { web3Enable, web3FromAddress } = await import('@polkadot/extension-dapp')
+  const { stringToHex } = await import('@polkadot/util')
+
+  const extensions = await web3Enable('libreDecision')
+  if (!extensions.length) {
+    throw new Error('Aucune extension Duniter détectée. Installez Cesium² ou Polkadot.js.')
+  }
+
+  let injector
+  try {
+    injector = await web3FromAddress(address)
+  } catch {
+    throw new Error(`Adresse ${address.slice(0, 10)}… introuvable dans l'extension.`)
+  }
+
+  if (!injector.signer?.signRaw) {
+    throw new Error("L'extension ne supporte pas la signature de messages bruts.")
+  }
+
+  const { signature } = await injector.signer.signRaw({
+    address,
+    data: stringToHex(challenge),
+    type: 'bytes',
+  })
+  return signature
+}
+
 export interface DuniterIdentity {
   id: string
   address: string
@@ -65,15 +99,12 @@ export const useAuthStore = defineStore('auth', {
           },
         )
 
-        // Step 2: Sign the challenge
-        // In production, signFn would use the Duniter keypair to produce an Ed25519 signature.
-        // For development, we use a placeholder signature.
+        // Step 2: Sign the challenge via polkadot.js / Cesium2 extension
         let signature: string
         if (signFn) {
           signature = await signFn(challengeRes.challenge)
         } else {
-          // Development placeholder -- backend currently accepts any signature
-          signature = 'dev_signature_placeholder'
+          signature = await _signWithExtension(address, challengeRes.challenge)
         }
 
         // Step 3: Verify and get token