fix(app): 503 on storage failures, validated currency, lock release on shutdown, per-IP login limit, unit-only npm test

fix(auth): gate admin routes on the decoded path and in the actions themselves

fix(ui): shared safe-next validation, no lockout on success, logout origin check, tab/feed polish

fix(app): stop guard on boot failure, validate compaction interval, harden hooks

feat(app): wire config, singleton app bootstrap, and auth hooks