fix(omnl): production blockers for M0-M4 settlement stack

Exempt dashboard read APIs from anonymous rate limits, preserve nginx-injected auth, wire chain-mint and DB env through deploy/LXC scripts, resolve M3 token addresses from registry, and harden super-admin seeding.

Co-authored-by: Cursor <cursoragent@cursor.com>

services/token-aggregation/src/api/routes/omnl.ts

@@ -21,6 +21,34 @@ import {
   executeM2TokenMint,
   chainRailConfigured,
 } from '../../services/omnl-settlement-chain';
+import fs from 'fs';
+import path from 'path';
+
+function resolveMintTokenAddress(lineId: string, symbol?: string, tokenAddress?: string): string | undefined {
+  if (tokenAddress?.startsWith('0x')) return tokenAddress;
+  const registryPath =
+    process.env.OMNL_M2_TOKEN_REGISTRY ||
+    path.resolve(__dirname, '../../../../config/omnl-m2-token-registry.v1.json');
+  try {
+    const registry = JSON.parse(fs.readFileSync(registryPath, 'utf8')) as {
+      tokens: Array<{ omnlLine: string; symbol: string; address: string }>;
+    };
+    const id = lineId.trim().toUpperCase();
+    const byLine = registry.tokens.find((t) => t.omnlLine.toUpperCase() === id);
+    if (byLine?.address.startsWith('0x') && byLine.address !== '0x0000000000000000000000000000000000000000') {
+      return byLine.address;
+    }
+    if (symbol) {
+      const bySym = registry.tokens.find((t) => t.symbol.toLowerCase() === symbol.toLowerCase());
+      if (bySym?.address.startsWith('0x') && bySym.address !== '0x0000000000000000000000000000000000000000') {
+        return bySym.address;
+      }
+    }
+  } catch {
+    /* registry optional */
+  }
+  return undefined;
+}
 
 const router = Router();
 router.use(omnlRateLimiter);
@@ -381,6 +409,9 @@ router.post('/omnl/settlement/token-load', async (req: Request, res: Response) =
     return;
   }
 
+  if (!tokenAddress?.startsWith('0x')) {
+    tokenAddress = resolveMintTokenAddress(lineId, symbol, tokenAddress);
+  }
   if (!tokenAddress?.startsWith('0x')) {
     res.status(400).json({
       error: 'tokenAddress required for on-chain mint',