neuroalpha 0.2.0 → 0.3.12

package/public/legal.html

@@ -1,3 +1,4 @@
+<!-- Copyright (c) 2026 Roman A. Perepelkin. Licensed under the MIT License. -->
 <!doctype html>
 <html lang="ru">
 <head>
@@ -85,6 +86,27 @@
         <li>Используя сервис «НейроАльфа», Пользователь подтверждает, что осознаёт указанные риски и принимает все инвестиционные решения самостоятельно.</li>
       </ul>
     </section>
+
+    <section class="doc" id="requisites">
+      <h2>4. Реквизиты Исполнителя и контакты поддержки</h2>
+      <div id="legal-req-body">
+        <p>Загрузка реквизитов…</p>
+      </div>
+    </section>
+    <div style="text-align:center;color:var(--muted);font-size:13px;margin-top:16px">© 2026 Roman A. Perepelkin · Licensed under the MIT License</div>
   </div>
+  <script>
+    fetch('/api/public/legal').then((r) => r.json()).then((d) => {
+      const rows = [
+        d.ownerName ? `<li><b>Исполнитель:</b> ${d.ownerName}${d.status ? ` (${d.status})` : ''}</li>` : '',
+        d.inn ? `<li><b>ИНН:</b> ${d.inn}</li>` : '',
+        d.ogrn ? `<li><b>ОГРН / ОГРНИП:</b> ${d.ogrn}</li>` : '',
+        d.email ? `<li><b>Email технической поддержки:</b> <a href="mailto:${d.email}">${d.email}</a></li>` : '',
+        d.phone ? `<li><b>Телефон:</b> ${d.phone}</li>` : '',
+        d.address ? `<li><b>Местонахождение:</b> ${d.address}</li>` : '',
+      ].filter(Boolean).join('');
+      document.getElementById('legal-req-body').innerHTML = rows ? `<ul>${rows}</ul>` : '<p>Связь с поддержкой — в личном кабинете сервиса.</p>';
+    }).catch(() => {});
+  </script>
 </body>
 </html>

package/public/styles.css

@@ -1,3 +1,4 @@
+/* Copyright (c) 2026 Roman A. Perepelkin. Licensed under the MIT License. */
 :root {
   --bg: #0d1016;
   --panel: #13171f;
@@ -147,7 +148,11 @@ body.light .model-opt:hover:not(:disabled), body.light .model-opt.active { backg
 .model-manage-btn:hover { background: #ffffff0c; color: var(--accent); border-color: var(--line); }
 body.light .model-manage-btn:hover { background: #f0f3f6; }
 .pbtn { width: 34px; height: 34px; border-radius: 999px; padding: 0; display: inline-flex; align-items: center; justify-content: center; font-size: 14px; background: var(--bg); border: 1px solid var(--line); color: var(--text); transition: background .15s, border-color .15s, color .15s, transform .15s; flex: none; }
-.pbtn[hidden], .pbtn svg[hidden] { display: none; }
+.pbtn[hidden] { display: none; }
+#chat-action svg { display: none; }
+#chat-action[data-icon="mic"] #ico-mic { display: block; }
+#chat-action[data-icon="send"] #ico-send { display: block; }
+#chat-action[data-icon="stop"] #ico-stop { display: block; }
 .pbtn.action-btn { background: #ffffff0c; border-color: transparent; color: var(--text); }
 body.light .pbtn.action-btn { background: #eef1f5; color: #374151; }
 .pbtn.action-btn:hover:not(:disabled) { border-color: var(--violet); color: var(--violet); }
@@ -182,12 +187,28 @@ body.light .tbadge.run { background: #dbeafe; border-color: #93c5fd; }
 .progress .bar { position: absolute; inset: 0 auto 0 0; width: 0; background: #24467f; transition: width .2s; }
 .progress span { position: relative; font-size: 12px; padding: 0 8px; line-height: 22px; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; display: block; }
 .empty { margin-top: 30px; color: var(--muted); line-height: 1.7; max-width: 640px; }
+.empty.live-dash { margin-top: 14px; max-width: none; color: var(--text); line-height: 1.45; }
 .empty b { color: var(--text); }
+.ld-grid { display: grid; grid-template-columns: 1.15fr 0.85fr; gap: 16px; margin-top: 12px; }
+@media (max-width: 1100px) { .ld-grid { grid-template-columns: 1fr; } }
+.ld-card { background: var(--panel); border: 1px solid var(--line); border-radius: 10px; padding: 14px 16px; min-width: 0; }
+.ld-title { font-size: 13px; font-weight: 600; color: var(--text); margin-bottom: 8px; display: flex; justify-content: space-between; align-items: center; gap: 8px; }
+.ld-tl { position: relative; height: 26px; background: var(--bg); border: 1px solid var(--line); border-radius: 7px; overflow: hidden; margin: 8px 0 6px; }
+.ld-tl-done { position: absolute; top: 0; bottom: 0; background: rgba(63, 185, 80, 0.16); transition: left .25s, width .25s; }
+.ld-tl-train { position: absolute; top: 2px; bottom: 2px; background: rgba(79, 140, 255, 0.32); border: 1px solid var(--accent); border-radius: 5px; transition: left .25s, width .25s; display: flex; align-items: center; justify-content: center; font-size: 10.5px; font-weight: 600; color: var(--text); overflow: hidden; white-space: nowrap; }
+.ld-tl-test { position: absolute; top: 2px; bottom: 2px; background: rgba(63, 185, 80, 0.42); border: 1px solid var(--green); border-radius: 5px; transition: left .25s, width .25s; }
+.ld-ics { display: flex; align-items: flex-end; gap: 3px; height: 64px; padding-top: 8px; border-bottom: 1px solid var(--line); margin-top: 8px; }
+.ld-ic-bar { flex: 1; min-width: 4px; max-width: 18px; border-radius: 2px 2px 0 0; transition: height .2s; }
+.ld-syms { display: flex; flex-wrap: wrap; gap: 5px; margin-top: 10px; }
+.ld-sym { font-size: 11px; padding: 2px 7px; border-radius: 5px; background: var(--bg); border: 1px solid var(--line); color: var(--text); }
+.ld-sym.ok { border-color: rgba(63, 185, 80, 0.5); color: var(--green); }
 .verdict { margin: 16px 0 12px; font-size: 15px; line-height: 1.5; }
-.kpis { display: grid; grid-template-columns: repeat(4, 1fr); gap: 1px; background: var(--line); border: 1px solid var(--line); border-radius: 8px; overflow: hidden; }
+.kpis { display: grid; grid-template-columns: repeat(5, 1fr); gap: 1px; background: var(--line); border: 1px solid var(--line); border-radius: 8px; overflow: hidden; }
+@media (max-width: 1180px) { .kpis { grid-template-columns: repeat(3, 1fr); } }
 .kpi { background: var(--bg); padding: 10px 14px; cursor: help; }
-.kpi .v { font-size: 22px; font-weight: 600; }
-.kpi .l { font-size: 12px; color: var(--muted); }
+.kpi .v { font-size: 21px; font-weight: 600; line-height: 1.2; }
+.kpi .l { font-size: 12px; color: var(--muted); margin-top: 2px; }
+.kpi .sub { font-size: 11.5px; color: var(--muted); margin-top: 2px; line-height: 1.3; }
 .seg { display: inline-flex; border: 1px solid var(--line); border-radius: 6px; overflow: hidden; margin: 14px 0 6px; }
 .seg button { border: 0; border-radius: 0; padding: 3px 10px; font-size: 12px; color: var(--muted); }
 .seg button.active { background: var(--panel); color: var(--text); }
@@ -258,27 +279,29 @@ body.light input[type=checkbox].switch:checked { background: #1a7f37; border-col
 .headbar .b { height: 6px; background: var(--panel); border-radius: 3px; position: relative; }
 .headbar .b div { position: absolute; top: 0; bottom: 0; border-radius: 3px; }
 
-.settings-wrap { display: grid; grid-template-columns: 220px minmax(0, 740px); gap: 36px; align-items: start; }
-.snav { display: flex; flex-direction: column; gap: 3px; position: sticky; top: 0; }
+.settings-wrap { display: grid; grid-template-columns: 205px minmax(0, 740px); gap: 24px; align-items: start; min-width: 0; }
+@media (max-width: 1100px) { .settings-wrap { grid-template-columns: 180px minmax(0, 1fr); gap: 16px; } }
+.snav { display: flex; flex-direction: column; gap: 3px; position: sticky; top: 0; min-width: 0; }
 .snav #s-search { width: 100%; margin-bottom: 10px; background: transparent; border-color: var(--line); padding: 6px 10px; font-size: 13px; }
 .snav button { text-align: left; border: 0; padding: 7px 12px; border-radius: 6px; color: var(--muted); font-size: 13.5px; }
 .snav button:hover { background: #ffffff08; color: var(--text); }
 .snav button.active { background: #262b36; color: var(--text); font-weight: 500; }
 .snav .ssep { height: 1px; background: var(--line); margin: 8px 4px; }
 .snav .sreset { color: var(--muted); font-size: 12.5px; }
-.spane { min-width: 0; }
-.ssec { margin-bottom: 24px; }
+.spane { min-width: 0; overflow: hidden; }
+.ssec { margin-bottom: 24px; min-width: 0; }
 .stitle { font-size: 14px; font-weight: 600; margin: 2px 0 12px; color: var(--text); }
 .stitle.bar { display: flex; justify-content: space-between; align-items: center; gap: 12px; flex-wrap: wrap; }
-.scard { background: #141820; border: 1px solid var(--line); border-radius: 10px; padding: 0 20px; }
+.scard { background: #141820; border: 1px solid var(--line); border-radius: 10px; padding: 0 20px; min-width: 0; overflow: hidden; }
 .scard.spadded { padding: 16px 20px; }
-.srow { display: grid; grid-template-columns: 1fr auto; gap: 24px; align-items: center; padding: 15px 0; border-bottom: 1px solid var(--line); }
+.srow { display: grid; grid-template-columns: minmax(0, 1fr) auto; gap: 20px; align-items: center; padding: 15px 0; border-bottom: 1px solid var(--line); }
+.srow.sblock { display: flex; flex-direction: column; align-items: stretch; gap: 12px; padding: 16px 0; }
 .srow:last-child { border-bottom: 0; }
 .srow[hidden] { display: none; }
 .srow .slbl { font-weight: 600; font-size: 13.5px; color: var(--text); }
 .srow .hint { font-size: 12.5px; color: var(--muted); margin-top: 3px; line-height: 1.45; }
 .srow .mark { border: 0; padding: 0 0 0 8px; font-size: 11px; font-weight: 400; color: var(--yellow); text-decoration: underline dotted; }
-.srow select.sctrl { background: transparent; border: 1px solid transparent; padding: 5px 8px; font-weight: 500; text-align: right; cursor: pointer; }
+.srow select.sctrl { background: transparent; border: 1px solid transparent; padding: 5px 8px; font-weight: 500; text-align: right; cursor: pointer; max-width: 240px; }
 .srow select.sctrl:hover, .srow select.sctrl:focus { background: var(--bg); border-color: var(--line); }
 .srow input[type=number].sctrl { width: 110px; text-align: right; background: var(--bg); }
 input[type=checkbox].switch { appearance: none; width: 38px; height: 22px; background: #2b313d; border: 1px solid #3a4252; border-radius: 999px; position: relative; cursor: pointer; transition: background .15s, border-color .15s; flex: none; padding: 0; }
@@ -300,11 +323,13 @@ input[type=checkbox].switch:checked::after { transform: translateX(16px); backgr
 .llm-remote button { padding: 1px 8px; font-size: 12px; border-radius: 999px; color: var(--muted); }
 .llm-remote button:disabled { opacity: .5; }
 .row-gap { display: flex; gap: 8px; }
-form#llm-add, form#broker-form { display: grid; gap: 10px; }
-form#llm-add label, form#broker-form label { display: grid; grid-template-columns: 1fr 1.4fr; gap: 10px; align-items: center; }
+form#llm-add, form#broker-form { display: grid; gap: 10px; min-width: 0; }
+form#llm-add label, form#broker-form label { display: grid; grid-template-columns: minmax(150px, 1fr) minmax(0, 1.4fr); gap: 12px; align-items: center; min-width: 0; }
+form#llm-add label > input:not([type=checkbox]), form#llm-add label > select,
+form#broker-form label > input:not([type=checkbox]), form#broker-form label > select { width: 100%; min-width: 0; max-width: 100%; text-overflow: ellipsis; }
 form#llm-add label[hidden], form#broker-form label[hidden] { display: none; }
-form#llm-add label.check, form#broker-form label.check { grid-template-columns: 1fr auto; }
-form#llm-add input[type=checkbox] { width: 18px; height: 18px; }
+form#llm-add label.check, form#broker-form label.check { grid-template-columns: minmax(0, 1fr) auto; }
+form#llm-add input[type=checkbox]:not(.switch) { width: 18px; height: 18px; }
 .flash { animation: flash 2.5s ease-out; }
 @keyframes flash { 0% { background: var(--flash-bg); } 100% { background: transparent; } }
 
@@ -332,6 +357,15 @@ form#llm-add input[type=checkbox] { width: 18px; height: 18px; }
 table.cmp { font-size: 12.5px; }
 table.cmp th { padding: 4px 8px; font-size: 12px; }
 table.cmp td { padding: 3px 8px; }
+.secret-input { -webkit-text-security: disc; text-security: disc; font-family: monospace; }
+.brk-subtabs { display: flex; gap: 6px; margin: 10px 0 8px; border-bottom: 1px solid var(--line); padding-bottom: 6px; }
+.brk-subtabs button { background: transparent; border: 1px solid transparent; padding: 5px 12px; border-radius: 6px; font-weight: 500; color: var(--muted); }
+.brk-subtabs button.active { background: var(--bg); border-color: var(--line); color: var(--text); font-weight: 600; }
+.brk-alloc-wrap { margin: 6px 0 12px; padding: 8px 10px; background: var(--bg); border: 1px solid var(--line); border-radius: 8px; }
+.brk-alloc-bar { display: flex; height: 10px; border-radius: 5px; overflow: hidden; gap: 2px; margin-bottom: 7px; background: var(--line); }
+.brk-alloc-legend { display: flex; flex-wrap: wrap; gap: 6px 14px; font-size: 12px; color: var(--muted); }
+.brk-alloc-legend span { display: inline-flex; align-items: center; gap: 5px; }
+.brk-alloc-legend i { width: 9px; height: 9px; border-radius: 2px; display: inline-block; }
 
 @media (max-width: 900px) {
   body { overflow: auto; }

package/server/api/routes.js

@@ -1,20 +1,21 @@
+// Copyright (c) 2026 Roman A. Perepelkin. Licensed under the MIT License.
 import fs from 'node:fs';
 import path from 'node:path';
 import express from 'express';
 import { ROOT, strategyDefaults } from '../config.js';
 import { activeModelInfo } from '../llm/client.js';
-import { listProviders, getSelected, addProvider, updateProvider, deleteProvider, fetchRemoteModels, testProvider, selectModel } from '../llm/providers.js';
-import { listRuns, allRuns, getRun, getTrades, deleteRun, updateRunTitle, setRunShowcase, listShowcaseRuns, countUserRunsToday, countUserChatToday, listJournal, deleteJournal, addJournal, listSettingsHistory } from '../db.js';
-import { PLANS, effectivePlan, publicUser, createSession, deleteSession, registerUser, loginUser, ensureNotifyCode, ensureApiKey, getUserByApiKey, activateLocalLicense, listAllUsers, setUserPlan, createPromoCode, listPromoCodes, redeemPromoCode, parseCookies } from '../auth/index.js';
+import { listProviders, getSelected, addProvider, updateProvider, deleteProvider, fetchRemoteModels, testProvider, selectModel, resolveUpstreamForProxy, providerFetch } from '../llm/providers.js';
+import { listRuns, allRuns, getRun, getTrades, deleteRun, updateRunTitle, setRunShowcase, listShowcaseRuns, countUserRunsToday, countUserChatToday, listJournal, deleteJournal, addJournal, listSettingsHistory, kvGet, kvSet } from '../db.js';
+import { PLANS, effectivePlan, publicUser, getUserById, createSession, deleteSession, registerUser, loginUser, ensureNotifyCode, ensureApiKey, getUserByApiKey, activateLocalLicense, listAllUsers, setUserPlan, createPromoCode, listPromoCodes, redeemPromoCode, parseCookies, publicOAuthConfig, saveOAuthConfig, startOAuthRedirect, completeOAuthCallback, verifyTelegramLoginWidget } from '../auth/index.js';
 import { publicBillingConfig, saveBillingConfig, createYookassaPayment, verifyYookassaPayment, verifyUserLatestPayment, listAllPayments } from '../billing/yookassa.js';
-import { publicNotifyConfig, saveNotifyConfig, notifyUser } from '../notify/index.js';
+import { publicNotifyConfig, getNotifyConfig, saveNotifyConfig, notifyUser, createTelegramLoginChallenge, checkTelegramLoginChallenge, handleMaxWebhook } from '../notify/index.js';
 import { PARAMS } from '../params-meta.js';
 import { getSettings, updateSettings, resetSettings, revertSettingsChange } from '../settings.js';
 import { startModelResearch, cancelModelResearch, startStabilityCheck, cancelStabilityCheck } from '../model/research.js';
 import { forecastNow } from '../model/forecast.js';
 import { profilesInfo, startProfilesRefresh } from '../model/profiles.js';
 import { live } from '../model/live.js';
-import { brokersState, saveBrokerAccount, deleteBrokerAccount, syncBrokerAccount, prepareBrokerOrders, executeBrokerOrders, rejectBrokerOrders } from '../brokers/index.js';
+import { brokersState, saveBrokerAccount, deleteBrokerAccount, syncBrokerAccount, discoverBrokerAccounts, freezeBrokerBaseline, fetchBrokerHistory, prepareBrokerOrders, executeBrokerOrders, rejectBrokerOrders } from '../brokers/index.js';
 import { listNews } from '../news/index.js';
 import * as strategist from '../strategist/index.js';
 import { hub } from '../hub.js';
@@ -42,8 +43,62 @@ export function createRouter() {
     cloudMode: process.env.CLOUD_MODE === '1',
     plans: PLANS,
     notify: publicNotifyConfig(),
+    oauth: publicOAuthConfig(),
     billing: { enabled: publicBillingConfig().enabled },
   }));
+  r.get('/auth/oauth/:provider/start', (req, res) => {
+    try {
+      const origin = `${req.protocol}://${req.get('host')}`;
+      const url = startOAuthRedirect(req.params.provider, { origin, plan: req.query.plan || '' });
+      res.redirect(url);
+    } catch (e) {
+      res.redirect(`/landing?oauth_error=${encodeURIComponent(e.message)}`);
+    }
+  });
+  r.get('/auth/oauth/:provider/callback', async (req, res) => {
+    try {
+      const { user, plan } = await completeOAuthCallback(req.params.provider, req.query || {});
+      const token = createSession(user.id);
+      setCookie(res, token);
+      res.redirect(`/landing?oauth_ok=1${plan ? `&buy_plan=${encodeURIComponent(plan)}` : ''}`);
+    } catch (e) {
+      res.redirect(`/landing?oauth_error=${encodeURIComponent(e.message)}`);
+    }
+  });
+  r.get('/auth/telegram/callback', (req, res) => {
+    try {
+      const { tgToken } = getNotifyConfig();
+      const user = verifyTelegramLoginWidget(req.query || {}, tgToken);
+      const token = createSession(user.id);
+      setCookie(res, token);
+      res.redirect('/landing?oauth_ok=1');
+    } catch (e) {
+      res.redirect(`/landing?oauth_error=${encodeURIComponent(e.message)}`);
+    }
+  });
+  // Быстрый вход в 1 клик через бота Telegram или MAX
+  r.post('/auth/telegram/start', wrap((req, res) => {
+    const ch = req.body?.channel === 'max' ? 'max' : 'tg';
+    const nt = publicNotifyConfig();
+    if (ch === 'max') {
+      if (!nt.hasMaxToken || !nt.maxBotName) throw new Error('Бот MAX ещё не подключён администратором');
+      const code = createTelegramLoginChallenge();
+      return res.json({ code, botUrl: `https://max.ru/${encodeURIComponent(nt.maxBotName)}?start=${encodeURIComponent(code)}` });
+    }
+    if (!nt.hasTgToken || !nt.tgBotName) throw new Error('Telegram-бот ещё не подключён администратором');
+    const code = createTelegramLoginChallenge();
+    res.json({ code, botUrl: `https://t.me/${encodeURIComponent(nt.tgBotName)}?start=${encodeURIComponent(code)}` });
+  }));
+  r.get('/auth/telegram/poll', (req, res) => {
+    const st = checkTelegramLoginChallenge(req.query.code);
+    if (st.status === 'done' && st.userId) {
+      const u = getUserById(st.userId);
+      const token = createSession(u.id);
+      setCookie(res, token);
+      return res.json({ status: 'done', user: publicUser(u), token });
+    }
+    res.json(st);
+  });
   r.post('/auth/register', wrap((req, res) => {
     const u = registerUser(req.body || {});
     const token = createSession(u.id);
@@ -103,6 +158,7 @@ export function createRouter() {
   // Активация API-ключа облачной подписки на локальном npx-клиенте
   r.post('/license/activate', wrap(async (req, res) => {
     const lic = await activateLocalLicense(req.body?.apiKey, req.body?.cloudUrl);
+    llmChanged();
     res.json({ ok: true, license: lic, user: publicUser(req.user) });
   }));
 
@@ -126,6 +182,9 @@ export function createRouter() {
     if (pid) await verifyYookassaPayment(pid).catch(() => {});
     res.json({ ok: true });
   }));
+  r.post('/notify/max/webhook', wrap(async (req, res) => {
+    res.json(await handleMaxWebhook(req.body || {}));
+  }));
 
   // ---------- публичная витрина для лендинга ----------
   r.get('/public/showcase', (req, res) => {
@@ -144,31 +203,64 @@ export function createRouter() {
     });
     if (!runs.length) {
       try {
-        const ref = JSON.parse(fs.readFileSync(path.join(ROOT, 'investor', 'данные.json'), 'utf8').replace(/^\uFEFF/, ''));
-        if (ref?.cmp?.attention?.full) {
+        const ref = JSON.parse(fs.readFileSync(path.join(ROOT, 'config', 'seed-run.json'), 'utf8'));
+        const att = ref?.extra?.comparison?.attention;
+        if (att?.full) {
           runs.push({
-            id: 234,
-            title: 'Эталонная стратегия «Внимание через карту»',
-            params: { modelHorizon: 2, modelTopK: ref.params?.topK || 2, modelDirection: 'long', modelType: 'attention' },
-            metrics: ref.cmp.attention.full,
-            oos: ref.cmp.attention.oos || {},
-            period: ref.period || {},
-            curve: (ref.curves?.attention || []).slice(-180),
-            marketCurve: (ref.curves?.market || []).slice(-180),
+            id: 1,
+            title: ref.params?._title || 'Эталонная адаптивная стратегия «Внимание через карту»',
+            params: { modelHorizon: ref.params?.modelHorizon || 2, modelTopK: ref.params?.modelTopK || 3, modelDirection: ref.params?.modelDirection || 'longshort', modelType: 'attention' },
+            metrics: att.full,
+            oos: att.outOfSample || {},
+            period: ref.metrics?.period || {},
+            curve: (ref.extra?.curves?.attention || []).slice(-180),
+            marketCurve: (ref.extra?.curves?.market || []).slice(-180),
           });
         }
       } catch { /* ignore */ }
     }
-    res.json({ runs, plans: PLANS });
+    res.json({ runs, plans: PLANS, legal: getLegalInfo() });
   });
 
-  // ---------- админ-панель (пользователи, оплаты, ЮKassa, боты Telegram и MAX, витрина) ----------
+  // ---------- реквизиты оферты (для модерации ЮKassa) ----------
+  const DEFAULT_LEGAL = {
+    ownerName: 'Перепелкин Роман Александрович',
+    status: 'Индивидуальный предприниматель / Плательщик НПД',
+    inn: '',
+    ogrn: '',
+    email: 'support@neuroalpha.ru',
+    phone: '',
+    address: 'Российская Федерация',
+  };
+  const getLegalInfo = () => ({ ...DEFAULT_LEGAL, ...(kvGet('legalInfo') || {}) });
+  r.get('/public/legal', (req, res) => res.json(getLegalInfo()));
+
+  // ---------- админ-панель (пользователи, оплаты, ЮKassa, боты Telegram и MAX, витрина, реквизиты) ----------
   const requireAdmin = (req) => {
     if (!req.user || req.user.role !== 'admin') throw new Error('Доступно только администратору платформы');
   };
   r.get('/admin/state', wrap((req, res) => {
     requireAdmin(req);
-    res.json({ users: listAllUsers(), payments: listAllPayments(), promos: listPromoCodes(), billing: publicBillingConfig(), notify: publicNotifyConfig() });
+    res.json({ users: listAllUsers(), payments: listAllPayments(), promos: listPromoCodes(), billing: publicBillingConfig(), notify: publicNotifyConfig(), oauth: publicOAuthConfig(), legal: getLegalInfo() });
+  }));
+  r.post('/admin/oauth', wrap((req, res) => {
+    requireAdmin(req);
+    res.json({ ok: true, oauth: saveOAuthConfig(req.body || {}) });
+  }));
+  r.post('/admin/legal', wrap((req, res) => {
+    requireAdmin(req);
+    const b = req.body || {};
+    const next = {
+      ownerName: String(b.ownerName ?? '').trim(),
+      status: String(b.status ?? '').trim(),
+      inn: String(b.inn ?? '').trim(),
+      ogrn: String(b.ogrn ?? '').trim(),
+      email: String(b.email ?? '').trim(),
+      phone: String(b.phone ?? '').trim(),
+      address: String(b.address ?? '').trim(),
+    };
+    kvSet('legalInfo', next);
+    res.json({ ok: true, legal: getLegalInfo() });
   }));
   r.post('/admin/promo', wrap((req, res) => {
     requireAdmin(req);
@@ -182,9 +274,9 @@ export function createRouter() {
     requireAdmin(req);
     res.json(saveBillingConfig(req.body || {}));
   }));
-  r.post('/admin/notify', wrap((req, res) => {
+  r.post('/admin/notify', wrap(async (req, res) => {
     requireAdmin(req);
-    res.json(saveNotifyConfig(req.body || {}));
+    res.json(await saveNotifyConfig(req.body || {}));
   }));
   r.put('/runs/:id/showcase', wrap((req, res) => {
     requireAdmin(req);
@@ -205,6 +297,67 @@ export function createRouter() {
   r.post('/llm/test', wrap(async (req, res) => res.json(await testProvider(req.body?.providerId, req.body?.model))));
   r.post('/llm/select', wrap((req, res) => { selectModel(req.body?.providerId, req.body?.model); llmChanged(); res.json(llmState()); }));
 
+  // ---------- облачный ИИ-прокси для локальных npx-клиентов по APIKey или в демо-режиме ----------
+  const proxyUsesToday = (ident) => {
+    const day = new Date().toISOString().slice(0, 10);
+    const key = `llmProxy:${ident}:${day}`;
+    return { key, count: Number(kvGet(key, 0)) || 0 };
+  };
+  r.get('/llm/proxy/v1/models', (req, res) => {
+    res.json({ data: [{ id: 'Qwen/Qwen3.8-27B-FP8', object: 'model' }] });
+  });
+  r.post('/llm/proxy/v1/chat/completions', async (req, res) => {
+    try {
+      const ip = String(req.headers['x-forwarded-for'] || req.socket?.remoteAddress || 'anon').split(',')[0].trim();
+      let maxPerDay = 5;
+      let ident = `ip:${ip}`;
+      let planLabel = 'Демо (без ключа)';
+      if (req.user) {
+        const plan = effectivePlan(req.user);
+        maxPerDay = plan.maxChatPerDay;
+        ident = `u:${req.user.id}`;
+        planLabel = plan.name;
+      }
+      const u = proxyUsesToday(ident);
+      if (u.count >= maxPerDay) {
+        return res.status(429).json({
+          error: {
+            message: req.user
+              ? `Исчерпан дневной лимит ИИ-запросов по тарифу «${planLabel}» (${maxPerDay} в сутки). Расширьте тариф на https://neuroalpha.odant.org`
+              : `Исчерпан бесплатный демо-лимит (${maxPerDay} запросов в сутки). Получите бесплатный или платный APIKey на https://neuroalpha.odant.org`,
+          },
+        });
+      }
+      const t = resolveUpstreamForProxy();
+      if (!t) {
+        return res.status(503).json({ error: { message: 'На сервере neuroalpha.odant.org ещё не подключена апстрим-модель ИИ' } });
+      }
+      kvSet(u.key, u.count + 1);
+      const body = { ...(req.body || {}), model: t.model, stream: true };
+      if (!body.reasoning_effort && t.effort) body.reasoning_effort = t.effort;
+      const upstream = await providerFetch(t.provider, t.url, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', Accept: 'text/event-stream' },
+        body: JSON.stringify(body),
+        signal: AbortSignal.timeout(90000),
+      });
+      if (!upstream.ok) {
+        const txt = await upstream.text().catch(() => '');
+        return res.status(upstream.status).json({ error: { message: txt.slice(0, 300) || `HTTP ${upstream.status}` } });
+      }
+      res.setHeader('Content-Type', 'text/event-stream; charset=utf-8');
+      res.setHeader('Cache-Control', 'no-cache');
+      res.setHeader('Connection', 'keep-alive');
+      for await (const chunk of upstream.body) {
+        res.write(chunk);
+      }
+      res.end();
+    } catch (e) {
+      if (!res.headersSent) res.status(500).json({ error: { message: e.message } });
+      else res.end();
+    }
+  });
+
   // ---------- настройки ----------
   r.get('/settings', (req, res) => res.json(getSettings()));
   r.put('/settings', wrap((req, res) => res.json(updateSettings(req.body || {}, { source: 'user' }))));
@@ -256,9 +409,6 @@ export function createRouter() {
     }
     const body = req.body || {};
     const merged = { ...getSettings(), ...body };
-    if ((merged.modelUseTransformer || merged.modelType === 'transformer') && !plan.allowTransformer) {
-      throw new Error('Обучение нейросети-трансформера доступно на тарифе «Профи / Лаборатория».');
-    }
     const { runId, reused } = startModelResearch(merged, { source: 'user', force: !!body.force });
     res.json({ runId, reused: !!reused });
   }));
@@ -282,6 +432,7 @@ export function createRouter() {
 
   // ---------- брокерские счета (Т-Банк, Финам, Алор, БКС) ----------
   r.get('/brokers', (req, res) => res.json(brokersState()));
+  r.post('/brokers/discover', wrap(async (req, res) => res.json(await discoverBrokerAccounts(req.body || {}))));
   r.post('/brokers', wrap((req, res) => {
     const plan = effectivePlan(req.user);
     const cur = brokersState().accounts.length;
@@ -293,6 +444,8 @@ export function createRouter() {
   r.put('/brokers/:id', wrap((req, res) => res.json(saveBrokerAccount({ ...(req.body || {}), id: req.params.id }))));
   r.delete('/brokers/:id', wrap((req, res) => res.json(deleteBrokerAccount(req.params.id))));
   r.post('/brokers/:id/sync', wrap(async (req, res) => res.json(await syncBrokerAccount(req.params.id))));
+  r.post('/brokers/:id/history', wrap(async (req, res) => res.json(await fetchBrokerHistory(req.params.id))));
+  r.post('/brokers/:id/freeze-baseline', wrap(async (req, res) => res.json(await freezeBrokerBaseline(req.params.id))));
   r.post('/brokers/:id/prepare', wrap(async (req, res) => res.json(await prepareBrokerOrders(req.params.id))));
   r.post('/brokers/:id/execute', wrap(async (req, res) => res.json(await executeBrokerOrders(req.params.id))));
   r.post('/brokers/:id/reject', wrap((req, res) => res.json(rejectBrokerOrders(req.params.id))));