fix(omnl): production blockers for M0-M4 settlement stack

Exempt dashboard read APIs from anonymous rate limits, preserve nginx-injected auth, wire chain-mint and DB env through deploy/LXC scripts, resolve M3 token addresses from registry, and harden super-admin seeding.

Co-authored-by: Cursor <cursoragent@cursor.com>

services/settlement-middleware/src/workflows/external-transfer.ts

@@ -142,6 +142,8 @@ export async function processExternalTransfer(
         record.errors.push(
           `M2/M3 backing insufficient for token load (${loadAmount}/${req.amount}, M3 headroom ${m3Check.loadAmount})`,
         );
+        advance('FAILED');
+        return record;
       }
       const mint = await requestTokenMint({
         lineId: req.convertToCrypto.tokenLineId,

services/settlement-middleware/src/workflows/token-load.ts

@@ -1,9 +1,13 @@
 import { v4 as uuidv4 } from 'uuid';
+import fs from 'fs';
+import path from 'path';
 import {
   buildMoneySupplySnapshot,
+  findM2TokenByLineId,
   GL_CODES,
   m2FiatToTokenLoadAmount,
   m3TokenLoadAmount,
+  type M2TokenRegistryFile,
   type TokenLoadRequest,
   type SettlementRecord,
 } from '@dbis/settlement-core';
@@ -12,6 +16,29 @@ import { fetchGlBalances, postJournalEntry, resolveGlAccountId } from '../adapte
 import { requestTokenMint } from '../adapters/omnl';
 import { settlementStore } from '../store/settlement-store';
 
+function loadTokenRegistry(): M2TokenRegistryFile {
+  const registryPath =
+    process.env.OMNL_M2_TOKEN_REGISTRY ||
+    path.resolve(__dirname, '../../../config/omnl-m2-token-registry.v1.json');
+  return JSON.parse(fs.readFileSync(registryPath, 'utf8')) as M2TokenRegistryFile;
+}
+
+function resolveTokenAddress(req: TokenLoadRequest): string | undefined {
+  if (req.tokenAddress?.startsWith('0x')) return req.tokenAddress;
+  const registry = loadTokenRegistry();
+  const byLine = findM2TokenByLineId(registry, req.lineId);
+  if (byLine?.address.startsWith('0x') && byLine.address !== '0x0000000000000000000000000000000000000000') {
+    return byLine.address;
+  }
+  if (req.symbol) {
+    const bySym = registry.tokens.find((t) => t.symbol.toLowerCase() === req.symbol!.toLowerCase());
+    if (bySym?.address.startsWith('0x') && bySym.address !== '0x0000000000000000000000000000000000000000') {
+      return bySym.address;
+    }
+  }
+  return undefined;
+}
+
 export async function processTokenLoad(input: TokenLoadRequest): Promise<SettlementRecord> {
   const cfg = loadConfig();
   const profile = loadOfficeProfile();
@@ -106,7 +133,7 @@ export async function processTokenLoad(input: TokenLoadRequest): Promise<Settlem
       settlementRef: record.settlementId,
       dryRun: !cfg.production.allowChainMintExecute,
       symbol: req.symbol,
-      tokenAddress: req.tokenAddress,
+      tokenAddress: resolveTokenAddress(req),
     });
     advance('CHAIN_MINT_REQUESTED', { chainTxHash: mint.txHash });
     advance('SETTLED');