fix: 3 HIGH + 4 MEDIUM + 4 LOW bugs, env vars, security hardening

HIGH: garbled env vars in 5 files fixed (auth, admin, webhooks, tautulli)
HIGH: double /api prefix in frontend API client fixed
HIGH: committed Solana keypair removed from repo
MEDIUM: JWT_SECRET hardcoded fallback removed (now fails fast)
MEDIUM: admin settings update now validates numeric inputs
MEDIUM: wallet dead code removed from frontend API client
MEDIUM: backfill no longer blocks login (fire-and-forget)
LOW: vanity-keypair-coop.json added to .gitignore
LOW: SystemSettings.id default fixed (cuid -> 'default')
LOW: overseerClient in admin.ts made lazy-initialized
LOW: .env already in .gitignore (verified)

frontend/src/lib/api.ts

@@ -7,7 +7,7 @@ const API_URL =
 		: "http://localhost:3001/api");
 
 export const api = axios.create({
-	baseURL: `${API_URL}/api`,
+	baseURL: API_URL,
 	headers: {
 		"Content-Type": "application/json",
 	},
@@ -56,12 +56,9 @@ export const userApi = {
 	getLeaderboard: () => api.get("/users/leaderboard"),
 };
 
-// Wallet API
+// Wallet API - deprecated, wallets removed
 export const walletApi = {
-	getWallet: () => api.get("/wallet"),
-	createWallet: () => api.post("/wallet/create"),
-	connectWallet: (address: string) => api.post("/wallet/connect", { address }),
-	backupWallet: () => api.post("/wallet/backup"),
+	getBalance: () => api.get("/wallet"),
 };
 
 // Transactions API