fix(operator): harden S3/S2/S4 per adversarial review

9 confirmed findings (review wbdf3c0sd), all fixed:

S4 (capabilities):
- REGRESSION: /capabilities reported grin_relay:false for a working relay (S4
  wrongly coupled it to Grin chain serviceability). The relay is a non-custodial
  mailbox — wallet broadcasts locally — so it is decoupled again. Removed the now-
  dead grin_relay downgrade note.

S3 (bootstrap latch):
- A DELETE of the latch row escaped Locked without Tampered detection on a
  CLI-bootstrapped-but-no-users instance (adoption keyed off `users` only). Boot
  now adopts on has_any_users() OR has_any_admin_keys(), so a deleted latch
  re-latches Locked instead of silently dropping to uninitialized.
- bootstrap_admin's single-bootstrap guard was a check-then-insert race (two
  concurrent `setup` could seed two admins). It now takes the admin-keys mutation
  advisory lock (shared with add/revoke/rotate) at the top of its tx.

S2 (admin posture + landing):
- Hard bind guard matched loopback by string prefix ("localhost".starts_with) —
  "localhost.evil.com" slipped past. Now resolves via to_socket_addrs and requires
  EVERY resolved addr to be loopback.
- host_allowed's IPv6 loopback check was an unanchored prefix ("[::1]" matched
  "[::1].evil"); now anchored to exactly "[::1]" / "[::1]:port". +regression tests.
- Anti-clickjacking headers (X-Frame-Options/CSP) are now applied on the 403
  Host-reject path too (computed on both branches, headers added once).
- GET /api/v1/server-info now returns a BARE 404 when landing is off (the
  {error,code} envelope itself hinted the route exists).
- Public landing `chains` now uses the SAME serviceability predicate as
  /capabilities (no over-advertising an unserviceable chain).
- Removed the dead/misleading PUBLIC_EXPOSE_FEATURES toggle (never read; the
  feature tuple is intentionally never emitted anonymously).

Dismissed after verification: latch chains-by-flag (dup), title length bound
(operator-owned + escaped), prices:true with empty PRICES_ASSETS (documented).
140 lib + 140 integration green, no openapi drift, scans clean.

src/api/admin.rs

@@ -89,8 +89,8 @@ fn host_allowed(host: &str, onion: Option<&str>) -> bool {
         return true;
     }
     let h = host.to_ascii_lowercase();
-    // IPv6 loopback (with or without :port), e.g. "[::1]" / "[::1]:8081".
-    if h.starts_with("[::1]") || h == "::1" {
+    // IPv6 loopback, anchored: exactly "[::1]" or "[::1]:port" (not "[::1].evil").
+    if h == "[::1]" || h.starts_with("[::1]:") || h == "::1" {
         return true;
     }
     let bare = h.split(':').next().unwrap_or(&h);
@@ -119,10 +119,13 @@ pub async fn admin_plane_guard(
         .get(axum::http::header::HOST)
         .and_then(|h| h.to_str().ok())
         .unwrap_or("");
-    if !host_allowed(host, state.config.admin.onion.as_deref()) {
-        return (StatusCode::FORBIDDEN, "forbidden").into_response();
-    }
-    let mut resp = next.run(req).await;
+    // Compute the response on both paths, then apply the security headers once so
+    // the 403 Host-reject carries them too.
+    let mut resp = if host_allowed(host, state.config.admin.onion.as_deref()) {
+        next.run(req).await
+    } else {
+        (StatusCode::FORBIDDEN, "forbidden").into_response()
+    };
     let h = resp.headers_mut();
     h.insert("x-frame-options", HeaderValue::from_static("DENY"));
     h.insert(
@@ -719,12 +722,6 @@ pub async fn admin_features(
         "grin",
         "GRIN_OWNER_API_SECRET unset",
     );
-    note(
-        cfg.features.grin_relay,
-        effective.features.grin_relay,
-        "grin_relay",
-        "Grin chain not serviceable",
-    );
     note(
         cfg.features.nostr_identity,
         effective.features.nostr_identity,
@@ -771,6 +768,10 @@ mod tests {
         // A foreign host (DNS-rebinding) is rejected.
         assert!(!host_allowed("evil.example", None));
         assert!(!host_allowed("attacker.test:8081", None));
+        // Anchored: a host merely STARTING with a loopback form is rejected.
+        assert!(!host_allowed("[::1].evil.com", None));
+        assert!(!host_allowed("localhost.evil.com", None));
+        assert!(!host_allowed("127.0.0.1.evil.com", None));
         // The configured onion is allowed; others still rejected.
         assert!(host_allowed("abc.onion", Some("abc.onion")));
         assert!(host_allowed("abc.onion:80", Some("abc.onion")));

src/api/capabilities.rs

@@ -63,7 +63,7 @@ pub struct CapabilitiesResponse {
 /// present). A chain whose flag is on but whose source is unconfigured reports
 /// `enabled:false` — so `/capabilities` never advertises a chain that 404s, and
 /// a missing-secret downgrade is indistinguishable from a deliberately-off chain.
-fn chain_serviceable(config: &Config, asset: &str) -> bool {
+pub(crate) fn chain_serviceable(config: &Config, asset: &str) -> bool {
     let f = &config.features.chains;
     let c = &config.chains;
     match asset {
@@ -106,8 +106,9 @@ pub fn effective_capabilities(config: &Config) -> CapabilitiesResponse {
             },
         },
         features: FeatureCapabilities {
-            // The relay needs Grin chain access to be serviceable.
-            grin_relay: config.features.grin_relay && chain_serviceable(config, "grin"),
+            // The relay is a non-custodial mailbox (the wallet broadcasts
+            // locally), so it is NOT coupled to this backend's Grin chain access.
+            grin_relay: config.features.grin_relay,
             prices: config.features.prices,
             // Nostr identity needs the canonical PUBLIC_API_URL.
             nostr_identity: config.features.nostr_identity

src/api/landing.rs

@@ -19,7 +19,6 @@ use axum::{
 use serde::Serialize;
 
 use crate::config::Config;
-use crate::error::AppError;
 use crate::AppState;
 
 #[derive(Debug, Serialize)]
@@ -62,18 +61,13 @@ fn coarse_version() -> String {
 }
 
 fn enabled_chain_symbols(config: &Config) -> Vec<String> {
-    let c = &config.features.chains;
-    [
-        ("btc", c.btc),
-        ("ltc", c.ltc),
-        ("xmr", c.xmr),
-        ("wow", c.wow),
-        ("grin", c.grin),
-    ]
-    .iter()
-    .filter(|(_, on)| *on)
-    .map(|(sym, _)| sym.to_string())
-    .collect()
+    // Use the SAME serviceability predicate as /capabilities, so the public
+    // landing never advertises a chain that capabilities reports as off.
+    ["btc", "ltc", "xmr", "wow", "grin"]
+        .iter()
+        .filter(|sym| crate::api::capabilities::chain_serviceable(config, sym))
+        .map(|sym| sym.to_string())
+        .collect()
 }
 
 /// Build the public projection from config, honoring each per-field toggle.
@@ -94,14 +88,14 @@ pub fn build_server_info(config: &Config) -> ServerInfo {
     }
 }
 
-/// `GET /api/v1/server-info` — the landing read model. `404` when landing is off
-/// (so it does not hint that an admin plane exists).
-#[allow(clippy::result_large_err)]
-pub async fn server_info(State(state): State<Arc<AppState>>) -> Result<Json<ServerInfo>, AppError> {
+/// `GET /api/v1/server-info` — the landing read model. A BARE `404` when landing
+/// is off (matching an unmatched route — the `{error,code}` envelope would itself
+/// hint the route exists, so it is deliberately not used here).
+pub async fn server_info(State(state): State<Arc<AppState>>) -> Response {
     if !state.config.landing.enabled {
-        return Err(AppError::NotFound("not found".into()));
+        return StatusCode::NOT_FOUND.into_response();
     }
-    Ok(Json(build_server_info(&state.config)))
+    Json(build_server_info(&state.config)).into_response()
 }
 
 /// `GET /` — minimal HTML rendered from the read model; bare `404` when off.