fix(platform): harden social features — wallet auth, route validation, and cleanup

[Zena-park]

Context

Follow-up items from PR #52 code review — hardening the wallet-based social features (reviews, comments, reactions) on the platform server.

Tasks

Wallet Auth (wallet-auth.js)

• Fixed CHALLENGE_MESSAGE with no nonce/expiry → migrate to EIP-4361 (Sign-In with Ethereum) (review)
• verifyWalletSignature() doesn't guard against array-typed Express headers (review)
• Nonce cache uses FIFO eviction instead of LRU (review)

Route Consistency (routes/store.js)

• DELETE /reviews/:reviewId ignores :id param — add requireAppchain middleware (review)
• DELETE /comments/:commentId ignores :id param — add requireAppchain middleware (review)
• targetExists() in reactions doesn't verify target belongs to :id deployment (review)
• parentId for comments not validated (can reference non-existent or cross-deployment comments) (review)

Schema & Docs

• schema.sql:152 — Comment says "max 3 per deployment" but API enforces 10 (review)
• showroom-social-infra-guide.md:186 — Doc claims wallet-level rate limit but server only has IP-based (review)

Cleanup

• explore/[id]/page.tsx:7 — Remove unused authApi import (review)

Related

• PR feat(platform): Explore page redesign with social features and announcements #52