Add authentication to dispute endpoints and improve test coverage infrastructure

- Add get_authenticated_address() helper to extract wallet address from X-Wallet-Address header or JWT token
- Add authentication to dispute filing, evidence submission, verification, voting, and arbitrator authorization endpoints
- Replace hardcoded zero addresses with authenticated addresses from request headers
- Add DEV_MODE fallback for development without authentication
- Add --mock flag to experimental resource

packages/py/aitbc-crypto/archive/signing.py

@@ -0,0 +1,40 @@
+from __future__ import annotations
+
+from typing import Dict, Any
+
+import base64
+from hashlib import sha256
+
+from nacl.signing import SigningKey, VerifyKey
+
+from .receipt import canonical_json
+
+
+class ReceiptSigner:
+    def __init__(self, signing_key: bytes):
+        self._key = SigningKey(signing_key)
+
+    def sign(self, payload: Dict[str, Any]) -> Dict[str, Any]:
+        message = canonical_json(payload).encode("utf-8")
+        signature = self._key.sign(message)
+        return {
+            "alg": "Ed25519",
+            "key_id": base64.urlsafe_b64encode(self._key.verify_key.encode()).decode("utf-8").rstrip("="),
+            "sig": base64.urlsafe_b64encode(signature.signature).decode("utf-8").rstrip("="),
+        }
+
+
+class ReceiptVerifier:
+    def __init__(self, verify_key: bytes):
+        self._key = VerifyKey(verify_key)
+
+    def verify(self, payload: Dict[str, Any], signature: Dict[str, Any]) -> bool:
+        if signature.get("alg") != "Ed25519":
+            return False
+        sig_bytes = base64.urlsafe_b64decode(signature["sig"] + "==")
+        message = canonical_json(payload).encode("utf-8")
+        try:
+            self._key.verify(message, sig_bytes)
+            return True
+        except Exception:
+            return False