feat: explorer API, wallet, CCIP scripts, and config refresh

- Backend REST/gateway/track routes, analytics, Blockscout proxy paths.
- Frontend wallet and liquidity surfaces; MetaMask token list alignment.
- Deployment docs, verification scripts, address inventory updates.

Check: go build ./... under backend/ (pass).
Made-with: Cursor

docs/EXPLORER_API_ACCESS.md

@@ -13,6 +13,50 @@ The frontend is reachable at **https://explorer.d-bis.org** (FQDN) or by **VM IP
   2. **Same-origin /api** – When the site is served from the explorer host (FQDN `https://explorer.d-bis.org` or VM IP `http://192.168.11.140` / `https://192.168.11.140`), the frontend uses relative `/api` so all requests go through the same nginx proxy. If you open the frontend from elsewhere, the code falls back to the full Blockscout URL (CORS must allow it).
 - If the API returns **200** but the UI still shows no data, check the browser console for JavaScript errors (e.g. CSP or network errors).
 
+## Wallet connect fails with “nonce not found or expired”
+
+If the explorer shows a MetaMask sign-in failure such as:
+
+```text
+Authentication failed: nonce not found or expired
+```
+
+or the wallet signature request itself shows:
+
+```text
+Nonce: undefined
+```
+
+check the nonce endpoint directly:
+
+```bash
+curl -sS -H 'Content-Type: application/json' \
+  -X POST https://explorer.d-bis.org/explorer-api/v1/auth/nonce \
+  --data '{"address":"0x4A666F96fC8764181194447A7dFdb7d471b301C8"}'
+```
+
+If that returns an error mentioning:
+
+```text
+relation "wallet_nonces" does not exist
+```
+
+then the explorer backend is running without the wallet-auth schema migration. Run:
+
+```bash
+cd explorer-monorepo
+bash scripts/run-migration-0010.sh
+```
+
+`scripts/run-migration-0010.sh` now auto-detects the database layout:
+
+- **Standalone explorer DB**: applies the full Track 2-4 schema from `0010_track_schema.up.sql`
+- **Shared Blockscout DB**: applies only the explorer-owned auth/operator tables from `0010_track_schema.auth_only.sql`
+
+Do **not** pipe `0010_track_schema.up.sql` directly into the shared Blockscout database on VMID 5000; its `addresses` and `token_transfers` tables already exist with Blockscout's schema and the full migration will collide with them.
+
+The `Nonce: undefined` popup means the frontend asked for a nonce, got back an error instead of a nonce, and the old deployed frontend still opened the signature request anyway. After the helper migration, retry the nonce request and then retry wallet connect in the browser.
+
 ### Frontend env contract
 
 For the Next frontend in `frontend/`, keep the runtime base URL at the **host origin**, not the `/api` subpath:
@@ -340,6 +384,11 @@ The script checks:
 - HTTP 200 on `/api/v2/stats`, `/api/v2/blocks`, `/api/v2/transactions`.
 - Explorer frontend at `/` returns 200.
 - Chain 138 Snap companion site at `/snap/` returns 200 or 301 and contains expected content when 200.
+- The static Visual Command Center at `/chain138-command-center.html` returns 200 and contains expected architecture text.
+- Mission Control endpoints return healthy responses:
+  - `/explorer-api/v1/mission-control/stream`
+  - `/explorer-api/v1/mission-control/bridge/trace`
+  - `/explorer-api/v1/mission-control/liquidity/token/{address}/pools`
 
 **Full verification (single place for all checks — API, explorer, Snap):**
 
@@ -347,7 +396,7 @@ The script checks:
 bash scripts/verify-vmid5000-all.sh [BASE_URL]
 ```
 
-Run this after every deploy or nginx change to confirm explorer and Snap site are reachable and correct.
+Run this after every deploy or nginx change to confirm explorer, Snap site, Visual Command Center, and Mission Control are reachable and correct.
 
 ---