fix(qr): refuse extra keys in the v1 signing-request envelope

[Kshot3000]

Bug

The v1 signing-request envelope (Wire in src/qr/sign_request.rs) accepts envelopes carrying extra keys, while every other reader of this wire format refuses them:

• The module documentation states the wallets "accept these three keys and no others" (v, signer, payload).
• The SDK's SigningRequest.decode (quantus-apps, quantus_sdk/lib/src/models/signing_request.dart) enforces exactly that key set for v1 via its exact-keys check.
• The v2 NEAR envelope in this same file already enforces it with deny_unknown_fields, and has a test that refuses an added signer key.

The v1 struct was missed, so it has neither the attribute nor a test. This is not just a formatting nit: the cold-signing flow (src/cli/cold_signing.rs) decodes a scanned request with AnySignRequest::decode and signs the payload after checking the signer. A v1 request with extra keys — for example a smuggled chain field — is signed by this CLI but refused by the mobile app, the cold wallet app, and the Keystone firmware. The readers of a security envelope should agree on what they accept.

Fix

Add #[serde(deny_unknown_fields)] to the v1 Wire struct — one line, matching the NEAR envelope — plus a regression test (refuses_extra_keys_like_the_wallets_do) that mirrors the existing NEAR extra-key test: a v1 envelope with an added chain key must fail both SignRequest::decode and AnySignRequest::decode.

Verification

• Red/green in this crate: SKIP_CIRCUIT_BUILD=1 cargo test --lib qr::sign_request — 11 passed / 1 failed without the fix (the new test: the extra-key envelope decoded successfully), 12/12 passed with it. (SKIP_CIRCUIT_BUILD is build.rs's documented flag for jobs that don't need the generated circuit binaries.)
• Full cargo test --lib: 422 passed; the only 2 failures (batch-verifier loading, one keystore migration test) fail identically on the unpatched tree in this environment and are unrelated to this change.
• Disclosure per this repo's SECURITY.md: I used AI tooling to help find and write up this issue.

---

@Quantus-Network — flagging for the team.

Built by @Kshot9000 (https://x.com/kshot9000) · QTC donations: qznY8nwuvWcCCVys4da1oQdysyh8YUZYRjRqgk3S8Wos8kbau