security: Harden /api/vault route (auth check + stop leaking error details) #246

[Security] Harden /api/vault route (auth check + stop leaking error details)

Summary

src/app/api/vault/route.ts accepts encrypt/verify actions from any caller with client-supplied keyMaterial, with no authentication or session check, and returns raw error.message to the client on failure. This is called from src/components/security/RelayerVault.tsx, which is reachable in the UI.

Why this matters

For a project whose core value proposition is security tooling, an unauthenticated endpoint that handles vault/secret operations and echoes internal error details is a meaningful gap. This is the highest-impact security fix currently open in the repo.

Acceptance criteria

• /api/vault POST requires an authenticated/authorized session before processing encrypt/verify actions
• Error responses return a generic message to the client; internal error details are logged server-side only, not returned in the response body
• Tests cover the unauthenticated-request-rejected case and the sanitized-error-response case

Technical context

src/app/api/vault/route.ts, src/services/vault.ts, src/services/vault-node.js, consumer: src/components/security/RelayerVault.tsx.