epic: Embedded Wallet PoC

[Danziger]

Before merge:

• Add screenshots on the mocked screens.
• Verify the regular build is unaffected.
• Create individual issues for the SDK, server, app...
• Pass a value to activeTab.url

Apps / Modules

• Create build setup for ArConnect Embedded's iframe app (Vite).
• Create ArConnect Embedded's iframe app with mocked screens but (mostly) real functionality (except for backend).
• Create build setup for ArConnect Embedded's SDK (Vite).
• Create ArConnect Embedded's SDK with customization options.
• Create build setup for ArConnect Embedded's server.
• Create ArConnect Embedded's server with Runtime (TBD: Express, Lambda...) + DB (TBD) + Auth0.

Architecture Changes (Routing, Navigation, Messaging)

• Replace links to “dashboard” with the "quick settings" version within the same iframe. Check if we have feature parity.
  See Update most links to dashboard to open in quick-settings instead. #500
• Update router to be config-driven.
  See Config-based routing, wouter v3, custom useLocation() / navigate()  #556
• Alias/polyfill browser.i18n API.
• Alias/polyfill all other browser.* calls (with lazy-loading per view?).
• Add a hidden “launcher” to navigate to specific views (for development).
• Replace /src/injected.ts and /src/api/index.ts with something similar to Othent. There, the “api” module should actually be a strategy, so that we can have a different one for the embedded wallet that sends “requests” to the iframe using postMessage().
• popup.tsx (main file) needs to listen for postMessage() coming from the new injected API (similar to the Express server in Othent). Consider adding something similar to the JWTs in Othent so that only the actual app (and not some XSS snippet or malicious extension) can contact it.

TODO (before extracting router changes to their own PR):

• Add fallback for all ENV variables...
• Replace window.top.close() in AuthRequestsProvider.
• Replace browser.storage.local.get() with ExtensionStorage.getAll().
• Remove AuthHead from pages in the Auth popup. Consider doing the same for the wallet. Consider implementing a generic "PageWrapper" with/without visible scrollbars.

TODO (next):

• Replace onMessage and sendMessage with isomorphicOnMessage and isomorphicSendMessage (using the env variable). After this, there's probably no need to mock onConnect.
• The "unlock" page/state must be redefined for the embedded wallet. It would be a good opportunity to consider adding watch-only wallets and biometrics lock/unlock (on a service worker) separated from the passphrase.
• Get all usages of getDecryptionKey as we won't be using this in the embedded wallet...

---

• Update useEmbeddedWalletSetUp() to return a Redirect object.
• Update route guard/redirects for the embedded wallet and add placeholder pages for authentication and wallet creation/recovery.
• browser.storage.onChanged.addListener(handleAppConfigChange) cannot be replaced with ExtensionStorage and watchers won't work while on the same context / tab.
• Persist alarm's last run and implement logic to resume from there (// TODO: Record last alarm run in localStorage to continue the alarm when reloading...)
• There's no disconnect in the embedded wallet. There's log out.