fix: constrain registry wallet auth to mainnet

Author: a19q3

CHANGELOG.md

@@ -21,7 +21,8 @@
   localized statuses and copyable audit values. Publisher authorisation now
   accepts both JoyID
   (`joyid_ckb`) and standard CKB secp256k1 (`ckb_secp256k1`) principals through
-  the CCC CKB-signer boundary on mainnet or testnet. The frontend never accepts
+  the CCC CKB-signer boundary on mainnet. The chooser no longer exposes a
+  testnet option or constructs a testnet client. The frontend never accepts
   mnemonic words; traditional recovery phrases remain inside the wallet. CLI
   auth commands use `--wallet-signature`, with `--joyid-signature` retained as
   a visible compatibility alias, and the API adds the corresponding typed
@@ -30,7 +31,9 @@
   signers connect directly, while the remaining wallets use the same verified
   external-signature handoff instead of disappearing from the UI. Every entry
   now uses the corresponding official Nervos wallet-directory SVG rather than
-  an autogenerated letter mark or a runtime favicon.
+  an autogenerated letter mark or a runtime favicon. The chooser header no
+  longer reserves space for a hidden back control, so its title, explanatory
+  text, and wallet list share one left alignment edge.
 - Deploy the public Registry production slice at
   `api.registry.cellscript.dev` and `registry.cellscript.dev`: Postgres 17 is
   the authoritative write store, the Node 22 adapter persists source snapshots

services/registry-api/README.md

@@ -420,7 +420,7 @@ provide all of the following:
 1. a CKB signer connection;
 2. the compressed secp256k1 public key;
 3. a 65-byte recoverable signature over the canonical CKB message challenge;
-4. mainnet/testnet network identity and disconnect/change events.
+4. mainnet network identity and disconnect/change events.
 
 The UI merges CCC discovery into the stable directory, so a future compatible
 adapter upgrades the existing entry without adding a brand-specific Registry