Revert "fix(rpc): remove sudo signature verification from RPC handler"

This reverts commit e0393a1.

Author: echobt

crates/rpc-server/src/server.rs

@@ -907,9 +907,60 @@ async fn sudo_challenge_handler(
         );
     }
 
-    // Note: We don't verify sudo signature here - the P2P network validates
-    // ChallengeUpdate messages. The validator that broadcasts will sign with
-    // its key, and other validators verify against SUDO_KEY when they receive it.
+    // Verify the signature
+    let signature_bytes = match hex::decode(&request.signature) {
+        Ok(s) => s,
+        Err(_) => {
+            return (
+                StatusCode::BAD_REQUEST,
+                Json(serde_json::json!({
+                    "success": false,
+                    "message": "Invalid signature format"
+                })),
+            );
+        }
+    };
+
+    // Check signature length
+    if signature_bytes.len() != 64 {
+        return (
+            StatusCode::UNAUTHORIZED,
+            Json(serde_json::json!({
+                "success": false,
+                "message": "Invalid signature length"
+            })),
+        );
+    }
+
+    // Verify signature is from sudo key
+    let message = format!(
+        "sudo:{}:{}:{}",
+        request.action, request.challenge_id, request.timestamp
+    );
+
+    let signature = match sp_core::sr25519::Signature::try_from(signature_bytes.as_slice()) {
+        Ok(sig) => sig,
+        Err(_) => {
+            return (
+                StatusCode::UNAUTHORIZED,
+                Json(serde_json::json!({
+                    "success": false,
+                    "message": "Invalid signature format"
+                })),
+            );
+        }
+    };
+
+    let sudo_public = sp_core::sr25519::Public::from_raw(SUDO_KEY_BYTES);
+    if !sp_core::sr25519::Pair::verify(&signature, message.as_bytes(), &sudo_public) {
+        return (
+            StatusCode::UNAUTHORIZED,
+            Json(serde_json::json!({
+                "success": false,
+                "message": "Invalid signature - not from sudo key"
+            })),
+        );
+    }
 
     info!(
         action = %request.action,