feat: wallet private key export API with password verification

internal/auth/service.go

@@ -535,6 +535,18 @@ func sanitizeForUsername(s string) string {
 // If these fail, the admin user exists without a wallet/profile.
 // This is acceptable because EnsureAdmin runs once at startup and failures
 // are logged as warnings. A restart will skip user creation (already exists).
+// VerifyPassword checks if the password matches the user's stored hash.
+func (s *Service) VerifyPassword(userID uint, password string) error {
+	user, err := s.repo.FindByID(userID)
+	if err != nil {
+		return fmt.Errorf("user not found")
+	}
+	if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(password)); err != nil {
+		return fmt.Errorf("invalid password")
+	}
+	return nil
+}
+
 func (s *Service) EnsureAdmin(username, password string) error {
 	if _, err := s.repo.FindByUsername(username); err == nil {
 		return nil