Fix: Harden Quick Auth replay protection, error handling, and Ed25519 consensus codecs

[mertcano]

Description

This PR applies the workspace-wide audit across the Farcaster/XMTP repositories, hardening Quick Auth replay protection, standardizing error propagation, eliminating unhandled async paths, updating supply-chain dependencies, and implementing strict Ed25519 consensus signature codecs in Snapchain.

Vulnerabilities & Security Defects Remediated:

• Authentication & Replay Protection (quick-auth/hono-cloudflare-worker/src/siwf.ts): Fixed a security vulnerability where signature verification and nonce consumption were executed in parallel. The function now strictly verifies the signature first and consumes the nonce only upon successful verification, preventing invalid signature requests from draining valid nonces.
• Error Propagation & Information Disclosure (quick-auth/hono-cloudflare-worker/src/app.ts): The /verify-siwf endpoint previously returned raw exception details to callers. It now logs exceptions with full context internally and returns a stable public error message (Failed to verify message).
• Async Failure Handling (quick-auth/hono-cloudflare-worker/src/durable-objects/noncePool.ts): scheduleCleanup() was previously invoked without awaiting its returned promise. It is now properly awaited so failures remain observable to the Durable Object request lifecycle.
• Consensus Runtime Safety (snapchain/src/core/types.rs): Replaced placeholder todo!() implementations for Ed25519 decode_signature and encode_signature with strict validation logic that enforces an exact 64-byte signature length and handles lossless encoding/decoding.
• Supply-Chain Security & Toolchain Correctness: Upgraded vulnerable versions of Hono and ws dependencies, and explicitly declared typescript in package.json to ensure clean typechecking across the worker environment.