- BTC (testnet) address/amount validation wired into send/receive
- Wallet-link now requires proof of address ownership before linking (fails closed)
- Google Drive as the third seed-backup copy (OAuth2 PKCE; dormant until configured)
- Cashback/coupon correctness fixes (exactly-once issuance, claim-stranding edge case)
- CI/CD: mirrored GitLab + GitHub pipelines (lint, type-check, test, audit, secret scan, contracts)
- Docs: architecture/operations updated, roadmap and AI-tools-usage overview added