fix: use correct Wownero network bytes and 2-byte varint prefix for address validation

The monero Python library assumes 1-byte network prefixes (Monero format).
Wownero uses 2-byte varint prefixes (base58 prefix 4146 for primary, 12208
for subaddress), so Address() was rejecting valid Wownero addresses with
"Primary address is invalid".

Replace monero lib Address usage with native Wownero validation:
- Correct netbytes: 0xb2 (primary), 0xb0 (subaddress), 0xb3 (integrated)
- 2-byte varint prefix offset for key extraction (bytes 2-33, 34-65)
- 2-byte varint prefix in subaddress derivation encoding

api/app/subaddress_derivation.py

@@ -3,16 +3,28 @@ from __future__ import annotations
 from binascii import hexlify, unhexlify
 import struct
 
-from monero import base58, const, ed25519
-from monero.address import Address
+from monero import base58, ed25519
 from monero.keccak import keccak_256
 
-# Override monero library network constants for Wownero
-from monero import const as _mc
-_mc.NETS = ('main',)
-_mc.MASTERADDR_NETBYTES = (53,)   # Wownero mainnet address prefix
-_mc.SUBADDR_NETBYTES = (63,)      # Wownero subaddress prefix
-_mc.INTADDRR_NETBYTES = (54,)     # Wownero integrated address prefix
+# Wownero network prefix bytes (first byte of varint-encoded base58 prefix).
+# Primary: base58 prefix 4146 -> varint [0xb2, 0x20]  -> "Wo"
+# Subaddr: base58 prefix 12208 -> varint [0xb0, 0x5f] -> "Ww"
+_WOW_PRIMARY_VARINT = bytes([0xb2, 0x20])
+_WOW_SUBADDR_VARINT = bytes([0xb0, 0x5f])
+
+
+def _decode_wow_address(payment_address: str) -> tuple[bytes, bytes]:
+    """Decode a Wownero primary address and return (pub_spend, pub_view) as raw bytes."""
+    decoded = bytearray(unhexlify(base58.decode(payment_address)))
+    # Verify checksum
+    if decoded[-4:] != keccak_256(decoded[:-4]).digest()[:4]:
+        raise ValueError("Invalid checksum")
+    if decoded[0] != _WOW_PRIMARY_VARINT[0]:
+        raise ValueError(f"Not a Wownero primary address (netbyte {decoded[0]})")
+    # 2-byte varint prefix, then 32-byte spend key, 32-byte view key, 4-byte checksum
+    pub_spend = bytes(decoded[2:34])
+    pub_view = bytes(decoded[34:66])
+    return pub_spend, pub_view
 
 
 def derive_subaddress(
@@ -22,9 +34,9 @@ def derive_subaddress(
     account_index: int,
     address_index: int,
 ) -> str:
-    address = Address(payment_address)
+    """Derive a Wownero subaddress from a primary address and secret view key."""
+    pub_spend, _pub_view = _decode_wow_address(payment_address)
     view_key_bytes = unhexlify(view_key)
-    spend_pub_bytes = unhexlify(address.spend_key())
 
     data = (
         b"SubAddr\0"
@@ -33,9 +45,9 @@ def derive_subaddress(
     )
     m = ed25519.scalar_reduce(keccak_256(data).digest())
     mG = ed25519.scalarmult_B(m)
-    D = ed25519.edwards_add(spend_pub_bytes, mG)
+    D = ed25519.edwards_add(pub_spend, mG)
     C = ed25519.scalarmult(view_key_bytes, D)
-    prefix = const.SUBADDR_NETBYTES[const.NETS.index(address.net)]
-    payload = bytearray([prefix]) + D + C
+    # Wownero subaddress uses 2-byte varint prefix
+    payload = bytearray(_WOW_SUBADDR_VARINT) + D + C
     checksum = keccak_256(payload).digest()[:4]
     return base58.encode(hexlify(payload + checksum))