Complete wallet sign-in and get a JWT

Verifies the signature over the challenge message and returns an ordinary user JWT — the same token social login and email-OTP produce.

First sign-in for an address creates a user and org. That user's email starts synthetic (email_pending: true) and unverified: a wallet signature proves possession of a key, not a reachable person. Staking redemption refuses until a real address is added and confirmed.

The wallet recovered from the signature is stored on the account and is the identity staking points are counted against. It is never accepted from a request body anywhere.