chore: sync docs, config schemas, scripts, and meta task alignment

- Institutional / JVMTM / reserve-provenance / GRU transport + standards JSON
- Validation and verify scripts (Blockscout labels, x402, GRU preflight, P1 local path)
- Wormhole wiring in AGENTS, MCP_SETUP, MASTER_INDEX, 04-configuration README
- Meta docs, integration gaps, live verification log, architecture updates
- CI validate-config workflow updates

Operator/LAN items, submodule working trees, and public token-aggregation edge
routes remain follow-up (see TODOS_CONSOLIDATED P1).

Made-with: Cursor

scripts/fix-explorer-http-api-v1-proxy.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+# Ensure the explorer nginx HTTP server block proxies /api/v1/ to token-aggregation.
+# Run inside VMID 5000.
+
+set -euo pipefail
+
+CONFIG_FILE="${CONFIG_FILE:-/etc/nginx/sites-available/blockscout}"
+TOKEN_AGG_PORT="${TOKEN_AGG_PORT:-3001}"
+
+if [[ ! -f "$CONFIG_FILE" ]]; then
+  echo "Config not found: $CONFIG_FILE" >&2
+  exit 1
+fi
+
+python3 - "$CONFIG_FILE" "$TOKEN_AGG_PORT" <<'PY'
+from pathlib import Path
+import sys
+
+cfg = Path(sys.argv[1])
+port = sys.argv[2]
+text = cfg.read_text()
+
+parts = text.split("# HTTPS server - Blockscout Explorer", 1)
+if len(parts) != 2:
+    raise SystemExit("Could not locate HTTP/HTTPS server boundary")
+
+http_block, https_block = parts
+
+if "location /api/v1/" in http_block:
+    print("HTTP block already has /api/v1/")
+    raise SystemExit(0)
+
+marker = "    # Blockscout API endpoint - MUST come before the redirect location\n"
+if marker not in http_block:
+    raise SystemExit("HTTP block marker not found")
+
+snippet = f"""    # Token-aggregation API (Chain 138 Snap: market data, swap quote, bridge routes)
+    location /api/v1/ {{
+        proxy_pass http://127.0.0.1:{port}/api/v1/;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 60s;
+        add_header Access-Control-Allow-Origin *;
+    }}
+
+    # Blockscout API endpoint - MUST come before the redirect location
+"""
+
+http_block = http_block.replace(marker, snippet, 1)
+cfg.write_text(http_block + "# HTTPS server - Blockscout Explorer" + https_block)
+print(f"Inserted HTTP /api/v1/ proxy to 127.0.0.1:{port}")
+PY
+
+nginx -t
+nginx -s reload