fix: resolve assigned security issues

[oche11207-art]

Closes #448, #442, #439, #431

Changes

#448 - deviceId stored unencrypted in localStorage

• Replaced localStorage-based device ID with per-session in-memory ID
• Added \hashDeviceId()\ for use cases requiring persistence

#442 - Chainalysis API key exposed via window global

• Removed \window.CHAINALYSIS_API_KEY\ from client-side code
• Created /api/security/address-check\ proxy API route
• API key is now read from \CHAINALYSIS_API_KEY\ env var server-side only
• Added \checkAddressRiskViaProxy()\ for browser-side calls

#439 - chart.tsx uses dangerouslySetInnerHTML for SVG payload

• Added DOMPurify sanitization for style tag content
• Extracted CSS building into pure \�uildChartCSS()\ function
• Sanitizes CSS before injecting into DOM

#431 - batchTransaction confirmation logic races simulation branches

• Replaced \Math.random()\ simulation with real viem provider reads
• Demo/simulation path now behind \NEXT_PUBLIC_DEMO_TX\ feature flag
• Uses \waitForTransactionReceipt\ for production path

Testing

• All typecheck errors are pre-existing and unrelated to these changes
• Added \NEXT_PUBLIC_DEMO_TX=false\ to .env.example

[nanaf6203-bit]

Same head SHA as #560 (literally identical commit 64ff095…). Closing this duplicate.

[nanaf6203-bit]

Thanks @oche11207-art — strong set of fixes covering #448, #442, #439, #431. Solid work on deviceId, Chainalysis, ChartStyle, and batch-tx. This branch has merge conflicts against current main though. Please rebase and resolve before we can land it. 🔒