fix: require signature for tokenpocket direct login

src/wallet/AutoInjectedLogin.tsx

@@ -1,10 +1,10 @@
 import { useEffect } from "react";
 import {
-  connectInjectedWallet,
   getInjectedWallet,
+  signInWithInjectedWallet,
   type WalletKind,
 } from "./injected";
-import { localWalletToken, useWallet } from "./WalletProvider";
+import { useWallet } from "./WalletProvider";
 
 const AUTO_LOGIN_PARAM = "autoLogin";
 const ETHEREUM_WAIT_MS = 8000;
@@ -46,8 +46,9 @@ function waitForInjected(kind: WalletKind): Promise<boolean> {
 /**
  * When the page is opened via a `?autoLogin=<wallet>` deeplink (typically from
  * inside TokenPocket / imToken in-app browsers), wait for the wallet to inject
- * `window.ethereum`, then complete a local wallet session automatically. Bypasses
- * WalletConnect entirely so it works on networks where the WC relay is blocked.
+ * `window.ethereum`, then require a wallet signature and complete a verified
+ * backend wallet session. Bypasses WalletConnect entirely so it works on
+ * networks where the WC relay is blocked.
  */
 export function AutoInjectedLogin() {
   const { completeLogin, status } = useWallet();
@@ -65,9 +66,9 @@ export function AutoInjectedLogin() {
     void waitForInjected(kind).then(async (ready) => {
       if (cancelled || !ready) return;
       try {
-        const address = await connectInjectedWallet(kind);
+        const res = await signInWithInjectedWallet(kind);
         if (cancelled) return;
-        completeLogin(localWalletToken(address), address);
+        completeLogin(res.token, res.wallet);
       } catch (err) {
         // eslint-disable-next-line no-console
         console.warn("[wallet-autologin] failed", err);