bitcoin-wallet, extracted into plugins/bitcoin-wallet — the platform half

Tenth extraction, and the first where the blocker was a permission rather than
a path. The wallet was kind: 'admin' — owner only, never grantable — and plugin
permissions are always kind: 'app'. mount.ts forces that and the manifest has
no field for anything else, deliberately, so a plugin cannot ask to be
restricted. Extraction therefore could not preserve admin.

Raised before moving any code, because turning "the server owner's bitcoin"
into a row in the grants list beside Photos and Music is the kind of change
nobody notices until someone ticks it.

Made anyway, and the objection inverts: every wallet query is scoped by
user_id, taken from X-Officer-User which the platform injects from the session,
so granting the permission gives an account its OWN wallet rather than access
to anyone else's — including to the owner, whose bypass covers permission
checks and not query scoping. kind: 'admin' was single-user thinking.

Named bitcoin-wallet, not wallet: appName drives route, API prefix, table
prefix and install key together, so the name should say what it is. Tables are
bitcoin_wallet_*; the prefix guard normalises the hyphen. Verified free before
committing to it — no wallet table exists on any server, and db:push would
treat a rename as a drop plus a create.

registry.test.ts re-anchored: `wallet` was its canonical kind: 'admin' fixture
and its no-selfService fixture. Now user-admin/server-admin and terminal, with
a note that a plugin's permissions are always `app` — which is exactly why this
one needed a decision rather than a default.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/apps/officer-web/Screens/Dashboard/Wallet/WalletScreen.tsx

@@ -1,39 +0,0 @@
-import { Navigate, useLocation, useParams } from 'react-router';
-import type { LayoutNode } from 'officerdev';
-import { WorkspaceView, DEFAULT_WALLET_SECTION, walletSectionPath, isWalletSection } from 'officerdev';
-import { useDashboardState } from 'state/useDashboardState';
-import { defaultLayout } from './defaultLayout';
-
-// /wallet uses the Workspace/Panel system (like /command-hq): the wallet list and section nav on the left,
-// the section itself on the right. Both talk to the officer-wallet sidecar through the /api/wallet auth
-// proxy, which holds no key material of its own — seeds live encrypted in the sidecar and are decrypted
-// there only for the length of an unlock window.
-//
-// The open section is :section in the URL, the open wallet is ?wallet= and any coin-control selection is
-// ?coins=, so both panels read the URL with useParams/useSearchParams rather than passing state between
-// themselves over a channel. This screen backs both /wallet and /wallet/:section and is the single place
-// that decides what an absent or bogus section means.
-
-export const WalletScreen = () => {
-  const { section } = useParams();
-  const { search } = useLocation();
-  const workspace = useDashboardState<LayoutNode>('screens/wallet', defaultLayout);
-
-  // Bare /wallet, or a section that doesn't exist, resolves to a canonical URL rather than rendering a
-  // default while the address bar says something else — the nav highlight is derived from the URL. The
-  // ?wallet= param is deliberately carried through rather than dropped: /wallet?wallet=3 is a legitimate
-  // deep link and canonicalising the section must not silently change which wallet is open.
-  if (!isWalletSection(section)) {
-    return <Navigate to={`${walletSectionPath(DEFAULT_WALLET_SECTION)}${search}`} replace />;
-  }
-
-  return (
-    <div className="h-full w-full pt-2">
-      <WorkspaceView
-        workspace={workspace}
-        locked
-        appTypes={{ allowed: ['wallet-nav', 'wallet-view'], fallback: 'wallet-view' }}
-      />
-    </div>
-  );
-};

src/apps/officer-web/Screens/Dashboard/Wallet/defaultLayout.ts

@@ -1,11 +0,0 @@
-import type { LayoutNode } from 'officerdev';
-
-export const defaultLayout: LayoutNode = {
-  type: 'group',
-  id: 'wallet-root',
-  direction: 'horizontal',
-  children: [
-    { node: { type: 'panel', id: 'wallet-nav', appType: 'wallet-nav' }, size: 24 },
-    { node: { type: 'panel', id: 'wallet-view', appType: 'wallet-view' }, size: 76 },
-  ],
-};

src/apps/officer-web/Screens/Dashboard/Wallet/index.tsx

@@ -1 +0,0 @@
-export * from './WalletScreen';

src/apps/officer-web/Screens/Dashboard/index.tsx

@@ -15,7 +15,6 @@ export * from './Calendar';
 export * from './Contacts';
 export * from './CommandHQ';
 export * from './Gitea';
-export * from './Wallet';
 export * from './SystemMonitor';
 export * from './Activity';
 export * from './CodeEditor';