-
server: adopt lint block, fix clippy, fmt
-
Format the tree with rustfmt and add the lint + supply-chain gates
-
Enforce price cap on JSON path and stop wizard input loss (ultra-fuzz Run 10 UX)
-
server: replace global CSRF allowlist with per-route posture helpers
-
exorcise: B15b routes/pages/ + root routes doc comments