replaced in memory nonce in redis

[KAMALDEEN333]

Replace in-memory nonce store with Redis
closes #192
Contributor
Problem Statement
The signed-nonce authentication in wallet_auth.py keeps state in a
module-level dictionary:

_nonce_store: Dict[str, Tuple[str, float]] = {}
def clean_expired_nonces():
cutoff = time.monotonic() - NONCE_TTL
expired = [n for n, (, ts) in _nonce_store.items() if ts < cutoff]
for n in expired: _nonce_store.pop(n, None)
This dict is a per-process singleton. Two uvicorn workers do not share
state, so a nonce can be issued in worker A and consumed successfully in
worker B but rejected if nonce was issued in B and verified in A. Worse:
after a uvicorn reload, the dict is blown away, so issued-but-unused
nonces vanish (denial-of-service-by-deploy) and issued-and-consumed
nonce metadata is gone (ban replay-protection).

Why It Matters
This is the foundational replay-protection for the protocol. Without
shared state, the auth model collapses the moment the deployment hits >1
uvicorn worker, which is the basic uvicorn packaging.

Technical Context
Redis is already used by quantara/web_app/contract_tools/cache.py (see
get_redis_pool()). Pool is created lazily with redis.asyncio. Add a
thin NonceStore class to wallet_auth.py (or api/session.py) that
implements the same three methods, but read/write through Redis. Use
SET nonce EX 300 NX to issue and DEL to consume, where
NX guarantees no two workers can return the same nonce.

Expected Outcome
Nonce issuance/consumption is consistent across worker boundaries and
survives a deploy.

Acceptance Criteria

Restarting uvicorn mid-flight: outstanding nonces return 401 to any caller (auto-expired / non-existent).

Stress: 100 concurrent /nonce for the same wallet → 100 unique nonces (no duplicates).

Race: 2 concurrent signed POSTs with same nonce → exactly one 200, one 401.

tests/test_wallet_auth.py updated to use fakeredis.aioredis instead of the module-level dict.
Implementation Notes
Use redis.asyncio (get_redis_pool() already exists). Key shape:
quantara:nonce:{nonce} = wallet_id with EX=300. Never log the
nonce itself — they are seeds for replay attacks if leaked.

Files / Modules Affected

quantara/web_app/api/wallet_auth.py
quantara/web_app/contract_tools/cache.py