Under UseAccess, MakeApplicationCallTxWithAccess passed a ForeignAssets
entry of 0 straight into the access list, appending a zero-valued
(empty) ResourceRef. The AVM treats that as an empty box reference
rather than an asset reference, so a 0 asset id silently produced a
different, incorrect transaction instead of an error.

Reject asset id 0 in the access-list composition so callers must pass
an explicit box reference for that behavior.

Fixes #764.

Keep typed passwords after a failed change, require the network minimum
for a link fee, share the ARC-14 realm constants, reject self-payments of
the payee in the gateway, replace unknown with real types, cache the
request-table descriptions, and tidy the Liquid hello/credential checks.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Validate the stable-workflow tag and pass it through env, run the duplicate
account guard before any state change and let a signing account replace a
watch-only entry, reset Liquid hello per connection, keep link amounts as
text, bound the gateway amount, and keep the app rows on WC/Liquid.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Store the Liquid credential only after the wallet binding is checked,
refresh Liquid peer metadata per connection, require a transaction type
at admission, reject malformed gateway link amounts, exact base-unit
arithmetic and an error message in the gateway builder, a localized fee
toast, and a duplicate-account guard in every add-account mutation.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

HD create mode stores the mnemonic it shows; WC/Liquid show acfg/afrz/keyreg
effects and refuse stpf/hb; payment-link fee read as microalgos and capped;
gateway verifies receiver/asset/amount; scheduler responses validated; node
genesis hash checked against the built-in table; plus hardening of CI,
Docker, dependencies and smaller findings.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

- Executive summary detailing findings from the audit covering commits a5217ae..8001781.
- Identified two High severity issues related to HD account mnemonic handling and WalletConnect/Liquid transaction signing.
- Documented Medium and Low severity findings, including issues with payment link parameters and merchant gateway transaction validation.
- Included recommendations for each finding to enhance security and user experience.
- Verified and re-evaluated prior audit findings, with updates on their status.
- Conducted a dependency review, noting advisories and potential vulnerabilities.

Co-authored-by: nullun <git@nullun.com>