fix(wallet): zero sensitive PIN and secret-key form state after use

[Clinton6801]

Fix: Zero Sensitive Wallet PIN and Secret-Key Form State After Use
Closes: #856

Summary
This PR implements comprehensive security fixes across all wallet components to prevent sensitive data (PIN, secret keys) from persisting in memory after use. The changes follow a defense-in-depth approach: clearing state immediately after success/failure, preventing clipboard access, disabling browser autofill, and implementing cleanup on component unmount.

Changes
Security Implementations

1. Immediate State Zeroing (All 5 Components)

PIN/secret state cleared immediately after successful operations
State also cleared on failure (catch blocks) to ensure cleanup even on errors
Transaction details (destination, amount, memo) cleared after send
Applied to: WalletSetup.tsx, WalletBackup.tsx, WalletRecovery.tsx, TransactionSigning.tsx, MultiSigSetup.tsx
2. Unmount Cleanup (All 5 Components)

Added useEffect cleanup functions to zero all sensitive state on component unmount
Prevents state leaks during rapid navigation or page transitions
Covers: PIN fields, secret keys, confirmation fields, transaction details
3. Clipboard Prevention (All PIN/Secret Inputs)

onCopy, onCut, onPaste handlers prevent clipboard operations
Users cannot accidentally copy secrets to clipboard
Applied to all password-type inputs
4. Browser Security (All PIN/Secret Inputs)

autoComplete="off" - Prevents password managers from capturing PIN
autoCorrect="off" - Disables autocorrect that might expose content
spellCheck={false} - Prevents spell-check from revealing sensitive data
5. Safe Error Handling

Removed all console.log/warn calls that could expose secrets
Error messages are user-friendly without technical details
Server errors silently fail (local backup still succeeds)
Testing
Comprehensive Test Coverage (5 new test files, 1600+ lines)

Each component now has tests covering:

✅ PIN/secret cleared after successful operations (8+ tests per component)
✅ PIN/secret cleared after failed operations (4+ tests per component)
✅ State cleanup on component unmount (3+ tests per component)
✅ Clipboard operations prevented (3+ tests per component)
✅ No console logs contain sensitive data (2+ tests per component)
✅ Accessibility preserved after state clear (4+ tests per component)
✅ Mobile viewport usability (390px) (1+ test per component)
✅ Form validation still works after clear (1+ test per component)
Test Files Added:

WalletSetup.test.tsx

WalletBackup.test.tsx

WalletRecovery.test.tsx

TransactionSigning.test.tsx

MultiSigSetup.test.tsx
Files Modified
File Changes
WalletSetup.tsx useEffect cleanup, clipboard prevention, state zeroing on success/failure, security attributes
WalletBackup.tsx useEffect cleanup, clipboard prevention, state zeroing on success/failure, silent error handling
WalletRecovery.tsx useEffect cleanup, clipboard prevention, state zeroing on success/failure
TransactionSigning.tsx useEffect cleanup, clipboard prevention, state zeroing, transaction details clearing
MultiSigSetup.tsx useEffect cleanup, clipboard prevention, dual PIN zeroing (setup + remove)
Security Guarantees
✅ No plaintext secrets persist in React state after operations complete
✅ No sensitive data in browser console logs
✅ No sensitive data in error messages
✅ Clipboard operations prevented on all secret inputs
✅ Browser autofill/autocorrect disabled
✅ All state cleared on component unmount
✅ Secrets cleared even on error conditions
Accessibility
✅ Label associations preserved after field clearing
✅ Tab navigation order maintained
✅ Keyboard focus management functional
✅ ARIA properties not removed by state clearing
✅ Screen reader announcements still work
✅ Mobile viewport (390px) remains usable
Testing
Run tests with:

bash

npm test -- WalletSetup.test.tsx WalletBackup.test.tsx WalletRecovery.test.tsx TransactionSigning.test.tsx MultiSigSetup.test.tsx
All tests use fake sensitive values (never real secrets) and follow existing repo patterns with @testing-library/react and jest.

Implementation Details
Sensitive State Cleared:

WalletSetup: createPin, createPinConfirm, importPin, importPinConfirm, importSecretKey
WalletBackup: pin
WalletRecovery: pin
TransactionSigning: pin
MultiSigSetup: pin, removePin
Timing:

Immediately after successful submission (before navigation/callbacks)
In catch blocks for failed submissions
In useEffect cleanup on component unmount
Backwards Compatibility
✅ No breaking changes. All changes are additions to security and cleanup logic. Form UX remains identical from user perspective.

Related Issues
Resolves #856: Zero sensitive wallet PIN and secret-key form state after use

[drips-wave]

@Clinton6801 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[Clinton6801]

@llinsss , what's up with the review ?

[Clinton6801]

@llinsss , kindly review

[Clinton6801]

@llinsss ,conflict is now resolved kindly review