- wallets/overview: requireSuperAuth; select only id/userId/walletType/balance (no mnemonic leak); totalUsd now converts balances to USD via CoinGecko rates (stablecoins=1); lastPaidAmount via aggregate (no take:20 truncation); archived wallets excluded from all aggregates consistently
- commission-wallets: GET requireSuperAuth; PUT upserts only present types (no silent wipe) + address format validation
- activation: strict boolean check (rejects 'false' string)
- system/info: requireSuperAuth; drop unused sshOnion
- auth: no 'changeme' fallback; no auto super_admin escalation without SUPER_ADMIN_SECRET
- wallets-page: Active Wallets card shows activeWallets; drop dead commissionEnabled field
- migration 015: index on site_settings.key
- remove scripts/patch-issue-146.cjs (hardcoded Gitea token) and dead scripts/sync-agents.cjs
