bitcoin-wallet, extracted into plugins/bitcoin-wallet — the platform half

Tenth extraction, and the first where the blocker was a permission rather than
a path. The wallet was kind: 'admin' — owner only, never grantable — and plugin
permissions are always kind: 'app'. mount.ts forces that and the manifest has
no field for anything else, deliberately, so a plugin cannot ask to be
restricted. Extraction therefore could not preserve admin.

Raised before moving any code, because turning "the server owner's bitcoin"
into a row in the grants list beside Photos and Music is the kind of change
nobody notices until someone ticks it.

Made anyway, and the objection inverts: every wallet query is scoped by
user_id, taken from X-Officer-User which the platform injects from the session,
so granting the permission gives an account its OWN wallet rather than access
to anyone else's — including to the owner, whose bypass covers permission
checks and not query scoping. kind: 'admin' was single-user thinking.

Named bitcoin-wallet, not wallet: appName drives route, API prefix, table
prefix and install key together, so the name should say what it is. Tables are
bitcoin_wallet_*; the prefix guard normalises the hyphen. Verified free before
committing to it — no wallet table exists on any server, and db:push would
treat a rename as a drop plus a create.

registry.test.ts re-anchored: `wallet` was its canonical kind: 'admin' fixture
and its no-selfService fixture. Now user-admin/server-admin and terminal, with
a note that a plugin's permissions are always `app` — which is exactly why this
one needed a decision rather than a default.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/permissions/registry.test.ts

@@ -202,7 +202,9 @@ describe('self-service routes', () => {
   });
 
   test('permissions without the field are unaffected', () => {
-    expect(isSelfServiceRoute(PERMISSION_BY_KEY.get('wallet')!, 'PUT', '/api/wallet')).toBe(false);
+    // Was `wallet` until 2026-08-19, when it became `plugins/wallet/`. Any permission with no
+    // selfService field will do — this pins the absence, not the key.
+    expect(isSelfServiceRoute(PERMISSION_BY_KEY.get('terminal')!, 'PUT', '/api/terminal')).toBe(false);
   });
 });
 
@@ -242,9 +244,11 @@ describe('kinds', () => {
 
   test('admin permissions are never grantable', () => {
     const grantable = new Set(GRANTABLE_PERMISSIONS.map((c) => c.key));
-    // `headscale` was here until 2026-08-15, when it left with offscale. A plugin's permissions are
-    // registered at install from its manifest, so they are not in this compile-time list by design.
-    for (const key of ['user-admin', 'server-admin', 'wallet']) {
+    // `headscale` was here until 2026-08-15 when it left with offscale, and `wallet` until 2026-08-19.
+    // A plugin's permissions are registered at install from its manifest, so they are not in this
+    // compile-time list by design — and a plugin's are ALWAYS `app`, which is exactly why the wallet
+    // becoming one had to be a deliberate decision rather than a side effect.
+    for (const key of ['user-admin', 'server-admin']) {
       expect(PERMISSION_BY_KEY.get(key)?.kind).toBe('admin');
       expect(grantable.has(key)).toBe(false);
     }

src/servers/permissions/registry.ts

@@ -381,15 +381,6 @@ const CORE_REGISTRY: Permission[] = [
   // `headscale` lived here until 2026-08-15, when it left with the rest of offscale. A plugin declares
   // its own permissions in its manifest and they are registered at install — see plugins/mount.ts. The
   // platform no longer knows this permission exists, which is the entire point.
-  {
-    key: 'wallet',
-    label: 'Wallet',
-    description: "The server owner's bitcoin",
-    kind: 'admin',
-    // api: ['/wallet'],  // plugin — switched off 2026-08-13
-    api: [],
-    routes: ['/wallet'],
-  },
 ];
 
 // ── Derived lookups ───────────────────────────────────────────────────────────────────────────────