fix: use derive_safe_wallet instead of derive_proxy_wallet for default proxy derivation

[pck101001]

Summary

• Replace derive_proxy_wallet (EIP-1167) with derive_safe_wallet (Gnosis Safe) as the default proxy wallet derivation
• Change DEFAULT_SIGNATURE_TYPE from "proxy" to "gnosis-safe"
• Users can still pass --signature-type proxy for Magic Link accounts

Problem

The CLI derives the proxy wallet address using derive_proxy_wallet() (EIP-1167 minimal proxy, factory 0xaB45...), but Polymarket deploys Gnosis Safe wallets (factory 0xaacF...) for browser wallet users. The two derivation methods use different salt encoding, factory addresses, and init code hashes, producing completely different addresses for the same EOA.

This causes:

• wallet show displaying the wrong proxy address
• clob balance returning 0 (querying wrong address)
• approve set approving the wrong address
• setup wizard directing users to deposit to the wrong address

Changes

File	Change
src/config.rs	DEFAULT_SIGNATURE_TYPE: "proxy" → "gnosis-safe"
src/commands/wallet.rs	derive_proxy_wallet → derive_safe_wallet; default --signature-type → "gnosis-safe"
src/commands/setup.rs	derive_proxy_wallet → derive_safe_wallet
src/auth.rs	Decouple parse_signature_type from DEFAULT_SIGNATURE_TYPE constant to prevent incorrect mapping

Verification

# After the fix, the derived proxy address matches the API:
polymarket wallet show -o json        # proxy_address field
polymarket profiles get <eoa> -o json # proxyWallet field
# These two now return the same address.

Test plan

• cargo test — all 143 tests pass (94 unit + 49 integration)
• polymarket wallet show displays the correct Gnosis Safe proxy address
• polymarket clob balance returns the actual balance
• --signature-type proxy still works for Magic Link accounts

Fixes #14

---

Note

Medium Risk
Changes the CLI’s default signature type and derived funding/approval address, which can affect where users deposit funds and what address gets approved. Risk is moderated by still allowing explicit --signature-type overrides but misconfiguration could still lead to wrong addresses shown/used.

Overview
Updates the CLI to default signature_type to gnosis-safe (DEFAULT_SIGNATURE_TYPE and wallet create/import defaults), aligning derived “proxy wallet” addresses with Gnosis Safe instead of EIP-1167 proxies.

Introduces derive_wallet_for_type and wires it through wallet show/create/import and the setup wizard so the displayed/deposit proxy address matches the selected signature type, and simplifies auth signature-type parsing to map explicit strings (e.g., "proxy", "gnosis-safe") rather than depending on the default constant.

^{Written by Cursor Bugbot for commit c9255ca. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}