fix: prevent nonce poisoning (WAPI-1121)

[chakra-guy]

Summary

Prevents nonce poisoning attacks by deferring nonce persistence until after successful decryption. Previously, nonces were saved immediately on message receipt, allowing an attacker to send high-nonce messages that fail decryption but permanently block legitimate messages.

• Nonce is now confirmed via callback only after successful decryption in BaseClient
• Added MAX_NONCE_JUMP (100) to reject suspiciously large nonce jumps from known senders
• Added NaN recovery in nonce storage
• Added mutex around confirmNonce to prevent concurrent race conditions

Jira

• WAPI-1121

Test plan

• Unit tests for confirmNonce, NaN recovery, nonce regression prevention
• All existing unit tests pass (63/63)
• Lint passes

---

Note

Medium Risk
Changes transport-level deduplication/nonce persistence behavior and introduces a new confirmNonce handshake between transport and client; mistakes could drop or permanently block legitimate messages (e.g., missed confirmations or nonce-jump threshold).

Overview
Hardens inbound message handling against nonce-poisoning by deferring persistence of received nonces until after successful decryption: WebSocketTransport now emits message events with a confirmNonce() callback, and BaseClient calls it only when decryptMessage succeeds.

Adds additional nonce safety rails: rejects suspicious large nonce jumps from known senders (MAX_NONCE_JUMP), tracks pending nonces to avoid double-processing before confirmation, clears pending state on clear(), and makes nonce storage more robust via NaN recovery plus a mutex-protected confirmNonce path. Tests and changelog are updated accordingly.

^{Written by Cursor Bugbot for commit fd3a662. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

[adonesky1]

Few minor comments otherwise LGTM