v4.0.8 — get_actions date/block bounds, ds_pool routing fix, ws security override

A quick maintenance release on top of 4.0.7 — API query fixes, an indexing routing fix, sync-accounts UX, and a security override for ws.

Fixes

• get_actions sort=asc accepts mixed date/block bounds (#174). A block-number bound combined with an ISO-date bound no longer returns 400 Invalid time value; each bound is classified independently (positive integer → block_num, else → @timestamp), in v1 and v2. Also hardened: strict integer classification (a date without T is no longer misread as a block number) and the sort=asc recency window now applies to any date after bound. Block-number bounds remain the supported way to query ranges older than max_asc_window_days.
• get_tokens missing balances (#170): sync accounts now resolves a contract's transfer struct via the action's declared type, so contracts using a non-transfer struct name are no longer skipped.
• ds_pool dropped traces for unassigned contracts (#169): an off-by-one routed unassigned contracts to a non-existent queue under ds_pool_size: 1; they now route to ds_pool:1.
• hyp-control indexer stop no longer fails with Invalid URL: ws://localhost:undefined/local on pre-4.0 configs missing control_port (now defaults to 7002).

Improvements

• Accurate sync accounts live progress (#171): continuously-moving "holders scanned" / "balances" counters and current-contract display instead of a stuck 0/1.

Security

• ws — Uninitialized memory disclosure (medium): pinned ws to 8.20.1 across the dependency tree via overrides (transitive deps still resolved < 8.20.1).

Maintenance

• nodemailer 8.0.7 → 8.0.10, ioredis 5.10.1 → 5.11.0, @types/node 25.5.0 → 25.9.1; CI now runs Build & Test on dev.

Upgrade note: after upgrading, re-run ./hyp-control sync accounts <chain> (or sync all) to backfill token contracts that the previous detection bug skipped.

Full details in CHANGELOG.md.