feat: explorer API, wallet, CCIP scripts, and config refresh

- Backend REST/gateway/track routes, analytics, Blockscout proxy paths.
- Frontend wallet and liquidity surfaces; MetaMask token list alignment.
- Deployment docs, verification scripts, address inventory updates.

Check: go build ./... under backend/ (pass).
Made-with: Cursor

backend/api/rest/server.go

@@ -2,6 +2,7 @@ package rest
 
 import (
 	"context"
+	"crypto/rand"
 	"database/sql"
 	"encoding/json"
 	"fmt"
@@ -29,11 +30,11 @@ type Server struct {
 
 // NewServer creates a new REST API server
 func NewServer(db *pgxpool.Pool, chainID int) *Server {
-	// Get JWT secret from environment or use default
+	// Get JWT secret from environment or generate an ephemeral secret.
 	jwtSecret := []byte(os.Getenv("JWT_SECRET"))
 	if len(jwtSecret) == 0 {
-		jwtSecret = []byte("change-me-in-production-use-strong-random-secret")
-		log.Println("WARNING: Using default JWT secret. Set JWT_SECRET environment variable in production!")
+		jwtSecret = generateEphemeralJWTSecret()
+		log.Println("WARNING: JWT_SECRET is unset. Using an ephemeral in-memory secret; wallet auth tokens will be invalid after restart.")
 	}
 
 	walletAuth := auth.NewWalletAuth(db, jwtSecret)
@@ -48,6 +49,17 @@ func NewServer(db *pgxpool.Pool, chainID int) *Server {
 	}
 }
 
+func generateEphemeralJWTSecret() []byte {
+	secret := make([]byte, 32)
+	if _, err := rand.Read(secret); err == nil {
+		return secret
+	}
+
+	fallback := []byte(fmt.Sprintf("ephemeral-jwt-secret-%d", time.Now().UnixNano()))
+	log.Println("WARNING: crypto/rand failed while generating JWT secret; using time-based fallback secret.")
+	return fallback
+}
+
 // Start starts the HTTP server
 func (s *Server) Start(port int) error {
 	mux := http.NewServeMux()
@@ -99,7 +111,7 @@ func (s *Server) addMiddleware(next http.Handler) http.Handler {
 			}
 			w.Header().Set("Access-Control-Allow-Origin", origin)
 			w.Header().Set("Access-Control-Allow-Methods", "GET, POST, OPTIONS")
-			w.Header().Set("Access-Control-Allow-Headers", "Content-Type, X-API-Key")
+			w.Header().Set("Access-Control-Allow-Headers", "Authorization, Content-Type, X-API-Key")
 
 			// Handle preflight
 			if r.Method == "OPTIONS" {