audit: 2026-05-30 full-codebase audit — report, issues, docs, runbooks

Full-codebase-audit 2026-05-30 outputs:
- Audit report: 09 - Audits/Full Codebase Audit - 2026-05-30.md
- 81 issue files ISSUE-055..135 (decisions + 1 skipped no-brainer).
- Scanner docs from scratch (was zero): architecture, data model, API ref, payment
  flow, operations runbook + repo README.
- Doc-sync updates across API reference, data models, flows, design system.
- Secret Rotation Runbook (08 - Operations) for the exposed credentials.
- Reusable workflow guide (07 - Development) + .claude/workflows/full-codebase-audit.js.

Issues remain status:open intentionally — the code fixes are uncommitted-then-committed
working-tree changes per repo and aren't "resolved" until merged/deployed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

03 - API Reference/Trezor API.md

@@ -3,7 +3,7 @@ title: Trezor API
 tags: [api, payments, trezor, safekeeping]
 ---
 
-> **Last updated:** 2026-05-29 — aligned with code (see Doc vs Code Audit Report)
+> **Last updated:** 2026-05-30 — break-glass mode added (commit `b21df25`)
 
 # Trezor API
 
@@ -17,6 +17,12 @@ TREZOR_SAFEKEEPING_REQUIRED=false
 
 Only the literal value `true` makes Trezor proof mandatory during release/refund confirmation. When unset or `false`, release/refund flows continue without Trezor proof.
 
+## Break-glass mode
+
+When `TREZOR_SAFEKEEPING_REQUIRED=true` and the Trezor is unavailable (lost, dead battery, etc.), an admin can activate break-glass mode to bypass Trezor for up to 1 hour. Break-glass state is in-memory only and resets on server restart.
+
+See [[Admin API]] — _Break-glass (Trezor bypass)_ section for the three management endpoints (`GET`, `POST`, `DELETE /api/admin/settings/break-glass`). Activating break-glass fires an immediate Telegram alert via `tgNotify`.
+
 ## GET /api/trezor/registration-message
 
 Builds the exact message the user must sign to register a Trezor xpub.