- wallets/overview: requireSuperAuth; select only id/userId/walletType/balance (no mnemonic leak); totalUsd now converts balances to USD via CoinGecko rates (stablecoins=1); lastPaidAmount via aggregate (no take:20 truncation); archived wallets excluded from all aggregates consistently
- commission-wallets: GET requireSuperAuth; PUT upserts only present types (no silent wipe) + address format validation
- activation: strict boolean check (rejects 'false' string)
- system/info: requireSuperAuth; drop unused sshOnion
- auth: no 'changeme' fallback; no auto super_admin escalation without SUPER_ADMIN_SECRET
- wallets-page: Active Wallets card shows activeWallets; drop dead commissionEnabled field
- migration 015: index on site_settings.key
- remove scripts/patch-issue-146.cjs (hardcoded Gitea token) and dead scripts/sync-agents.cjs
- handleRename: city rename via /api/locations/rename-city (all rows), district via PUT /api/locations/{id}
- City-level delete: DELETE /api/locations/by-city (blocks on dependencies, 400 with counts)
- Sort order: idempotent ensureSortOrderColumns (ALTER TABLE try/catch) + PATCH /api/{type}s/{id}/sort + up/down arrows on district/category/subcategory
- Tree queries order by sort_order asc, then name
- Subcategory rename/delete verified
- tsc clean
- categories dialog: red hint with count + Deactivate button when products>0
- locations dialog: red hint + Deactivate button when categories/products>0
- catalog dialog: deleteError shown on 400/409; Deactivate for category/subcategory/location, Edit for product
- Deactivate calls existing PATCH toggle, closes dialog, reloads
- tsc clean
- compose: pass bot env (BOT_TOKEN, SUPPORT_LINK, ADMIN_IDS, SUPER_ADMIN_IDS, WG_*, ADMIN_*, GITEA_API_URL) to tg_shop_admin
- settings API: reads real env values; POST /api/settings reveals secret value by key (auth required)
- settings-page: eye/eye-off button on masked fields, shows real value on click (BOT_TOKEN, ADMIN_IDS, etc.)
- wallets/seeds: move user relation into nested select (was select+include -> PrismaClientValidationError 500)
- wallets/export-seeds: same fix (CSV export)
- Verified no other top-level select+include conflicts in api routes
- tsc clean
- New API /api/chatbot/models: fetches model list from configured endpoint (/models, OpenAI/Ollama format)
- Uses saved site_settings endpoint+key, or accepts endpoint/apiKey query params (unsaved custom provider)
- UI: 'Загрузить модели' button in Provider tab — loads models into select
- Manual model input always available for Custom providers
- No more hardcoded Ollama-only model list
- window.location.href='/' after login (was window.location.hash='/' which stayed on /login#/)
- checkSession on mount: already-authenticated users skip login form
