fix(analytics): replace insecure raw byte slice in hashPublicKey with…

[Chigybillionz]

Close #148 

### Summary of the Issue
`analytics.ts` contained a `hashPublicKey` function that claimed to sanitize Stellar wallet addresses before sending them to third-party analytics sinks (`gtag` / `dataLayer`). However, `hashPublicKey` did not perform any cryptographic hashing; it simply sliced the first 4 characters of the address and converted their ASCII byte values directly to hex. This exposed the initial characters of user wallet addresses and allowed reverse-lookup table attacks.
---
### Root Cause
The `hashPublicKey` function executed `TextEncoder().encode(publicKey).slice(0, 4)` and hex-encoded the raw ASCII bytes. Because all Stellar public keys begin with 'G' (ASCII `0x47`), the prefix was deterministic, low-entropy, and trivial to reverse to the raw address prefix. Different wallet addresses sharing the first four characters also generated identical outputs.
---
### Solution Implemented
Replaced the raw 4-byte slice in `hashPublicKey` with a full-input `SHA-256` cryptographic digest using the Web Crypto API (`crypto.subtle.digest`). The full string digest is hex-encoded and formatted into a 16-character pseudonymous identifier.
---
### Key Changes Made
- Updated `hashPublicKey` to calculate a proper SHA-256 digest across the complete `publicKey` string.
- Exported `hashPublicKey` and updated `trackEvent` to await the asynchronous sanitization before dispatching analytics events.
- Added a full-string fallback hash function (`fallbackHash`) for environments where Web Crypto is missing or disabled.
- Created `src/lib/analytics.test.ts` to thoroughly verify determinism, avalanche effect, prefix-collision resistance, and payload sanitization in `trackEvent`.
---
### Any Trade-Offs or Considerations
`hashPublicKey` is now asynchronous due to `SubtleCrypto.digest`. `trackEvent` handles this asynchronously before sending data to `gtag`/`dataLayer`, maintaining a fire-and-forget signature interface for call sites while guaranteeing wallet address privacy.
---
### Testing Steps (How to Verify the Fix)
1. Run the new analytics unit tests:
   ```bash
   npm test -- src/lib/analytics.test.ts

Run the entire project test suite:
bash
npm test
Observe that addresses sharing the "GABC" prefix (e.g. GABCDEFGHIJKLMNOPQRSTUVWXYZ234567ABCDEFGHIJKLMNOPQRSTUVWX and GABCZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ) generate completely distinct, irreversible 16-character hashes.
---
_Please kindly review this task. If there are any corrections, improvements, adjustments, or merge conflicts that you notice regarding my implementation, I'd really appreciate your feedback. I'd also love to hear your overall review of my work on this branch.Thank you!_

[netlify]

✅ Deploy Preview for spiffy-melomakarona-eb1e8a ready!

Name	Link
🔨 Latest commit	bcf2d6a
🔍 Latest deploy log	https://app.netlify.com/projects/spiffy-melomakarona-eb1e8a/deploys/6a833ee6ca1a9b0008ebb514
😎 Deploy Preview	https://deploy-preview-179--spiffy-melomakarona-eb1e8a.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[netlify]

✅ Deploy Preview for smart-drop ready!

Name	Link
🔨 Latest commit	bcf2d6a
🔍 Latest deploy log	https://app.netlify.com/projects/smart-drop/deploys/6a833ee6dac1ed00082282bc
😎 Deploy Preview	https://deploy-preview-179--smart-drop.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.