- Fix timing attack vulnerability in REST API key comparison by using constant-time byte comparison instead of short-circuit string equality
- Replace non-standard EVM key derivation (raw seed bytes) with proper BIP44 m/44'/60'/0'/0/0 hierarchical derivation via alloy MnemonicBuilder, producing addresses compatible with MetaMask and standard wallets
- Add configurable token-bucket rate limiting for REST and RPC endpoints with per-second and max-concurrent controls, preventing DoS via request flooding
- Block spend-limit-gated payments when the cached FX quote has fully expired instead of silently using stale rates, ensuring USD-denominated limits remain accurate
- Fix try_provider macro to continue trying remaining providers after a non-fatal error instead of stopping at the first failure, improving multi-provider resilience
- Unify wallet storage from per-network directories into a single wallets/ directory with one shared catalog, simplifying the data model and removing legacy path compatibility code
- Add sol and evm to default container build features so Docker and Apple container deployments include all supported networks out of the box