[Kewe63]

Description

• Track active authenticated connections per normalized solver address instead of storing only address presence.
• Increment the connection count on every successful login and decrement it on logout.
• Remove the signer from authenticated state only after its final connection closes.
• Preserve the existing boolean isLoggedIn(address) interface used by the server and price book.
• Add focused regression coverage for shared-signer lifecycle and unmatched logout calls.

Motivation and Context

AuthService previously stored authenticated solvers in a Set<string>. Two independently authenticated WebSockets using the same signer therefore shared one set entry, while each socket close called logout(address) and deleted that entry. Closing either socket deauthenticated the other active connection and prevented it from submitting prices.

A per-address active-connection count keeps the signer authenticated while at least one successful connection remains. The failed-upgrade path remains balanced because it logs out the successful login that immediately preceded the failed upgrade.

Fixes #239.

How Has This Been Tested?

• Loopback reproduction on the current canary source:
  • Distinct-signer control — exit 0; the remaining socket submitted prices.
  • Same-signer reproduction — exit 1; the remaining socket received Error: not authenticated.
• Pre-fix focused regression: 1 passed, 1 failed; the first logout removed the shared signer.
• bun test test/AuthService.shared-login.test.ts — 2 passed, 0 failed.
• Existing one-time nonce regression:
  • bun test test/Websocket.integration.test.ts -t 'Should reject parallel connections with the same nonce' — 1 passed, 0 failed.
• Direct TypeScript check of the changed source and test — passed with the package's current TypeScript version and --ignoreConfig.
• Full package suite after the fix — 3 passed, 3 failed. The three failures are unchanged baseline fixture/timing failures recorded by the audit: two stale price fixtures raise Invalid argument type in ToBigInt operation, and processIntentLogs.test.ts asserts an asynchronous notification before it occurs.
• git diff --check — passed.
• Independent code review — passed with no blocking findings; additional mixed-case, failed-login, and underflow checks also passed.

Types of changes (remove all unchecked types)

• Bug fix (non-breaking change which fixes an issue)

Checklist:

• I assessed the documentation impact; no documentation update is required.
• I assessed the deployment-script impact; no deployment-script update is required.
• I added focused regression coverage for shared-signer authentication lifecycle.