feat: improve wallet portfolio inspection

[dk3yyyy]

Summary

• add explicit fresh-data refresh while preserving the previous snapshot on provider failure
• add holdings search, sorting, and valued-dust filtering without hiding unpriced assets
• add browser-only CSV/JSON exports and fragment-only share links
• add retry/loading feedback, responsive action controls, and updated privacy documentation

Privacy and scope

• remains read-only: no wallet connection, signing, transactions, accounts, or persistent history
• exports are generated in the browser
• share links use URL fragments and do not auto-submit the address
• provider credentials remain server-side

Verification

• 30 passed — Python
• 10 passed — Playwright browser suite
• 2 passed — production Uvicorn/CSP suite
• Ruff passed
• Bandit medium/high scan passed
• npm audit: 0 vulnerabilities
• pip audit: no known vulnerabilities
• independent review verdict: SHIP

Dependency

This is a stacked PR targeting feat/web-ui. Merge PR #4 first, then retarget or merge this PR.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: bb913569-1bab-42a2-bb02-5d4c725af0c5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/web-ui-improvements

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}