fix(admin): review findings — auth, wallet overview math, commission PUT, activation

- wallets/overview: requireSuperAuth; select only id/userId/walletType/balance (no mnemonic leak); totalUsd now converts balances to USD via CoinGecko rates (stablecoins=1); lastPaidAmount via aggregate (no take:20 truncation); archived wallets excluded from all aggregates consistently
- commission-wallets: GET requireSuperAuth; PUT upserts only present types (no silent wipe) + address format validation
- activation: strict boolean check (rejects 'false' string)
- system/info: requireSuperAuth; drop unused sshOnion
- auth: no 'changeme' fallback; no auto super_admin escalation without SUPER_ADMIN_SECRET
- wallets-page: Active Wallets card shows activeWallets; drop dead commissionEnabled field
- migration 015: index on site_settings.key
- remove scripts/patch-issue-146.cjs (hardcoded Gitea token) and dead scripts/sync-agents.cjs

src/migrations/015_shop_activation.js

@@ -0,0 +1,36 @@
+import logger from '../utils/logger.js';
+
+// Migration 015: shop activation flag + commission wallet addresses in site_settings
+export default async function migration015(db) {
+    await db.runAsync('BEGIN TRANSACTION');
+    try {
+        // Индекс на key — site_settings читается ботом на каждое сообщение (shop_activated, commission_wallet_*)
+        await db.runAsync(
+            'CREATE INDEX IF NOT EXISTS idx_site_settings_key ON site_settings(key)'
+        );
+
+        // Shop activation flag: default true unless SHOP_ACTIVATED='false'
+        const shopActivated = process.env.SHOP_ACTIVATED === 'false' ? 'false' : 'true';
+        await db.runAsync(
+            "INSERT OR IGNORE INTO site_settings (key, value) VALUES ('shop_activated', ?)",
+            [shopActivated]
+        );
+
+        // Commission wallet addresses: seed from env if set, otherwise empty string
+        const walletTypes = ['BTC', 'LTC', 'USDT', 'USDC', 'ETH'];
+        for (const type of walletTypes) {
+            const envKey = `COMMISSION_WALLET_${type}`;
+            const value = process.env[envKey] || '';
+            await db.runAsync(
+                "INSERT OR IGNORE INTO site_settings (key, value) VALUES (?, ?)",
+                [`commission_wallet_${type}`, value]
+            );
+        }
+
+        await db.runAsync('COMMIT');
+        logger.info('Migration 015: shop_activation and commission_wallet_* seeded into site_settings');
+    } catch (e) {
+        await db.runAsync('ROLLBACK');
+        throw e;
+    }
+}