neuroalpha 0.6.12 → 0.7.0

package/server/api/routes.js

@@ -1,906 +1,570 @@
-// Copyright (c) 2026 Roman A. Perepelkin. All rights reserved. Proprietary software.
-import fs from 'node:fs';
-import path from 'node:path';
-import express from 'express';
-import { ROOT, strategyDefaults } from '../config.js';
-import { activeModelInfo } from '../llm/client.js';
-import { listProviders, getSelected, addProvider, updateProvider, deleteProvider, fetchRemoteModels, testProvider, selectModel, resolveUpstreamForProxy, providerFetch } from '../llm/providers.js';
-import { listRuns, allRuns, getRun, getTrades, deleteRun, updateRunTitle, setRunShowcase, listShowcaseRuns, countUserRunsToday, countUserChatToday, listJournal, deleteJournal, addJournal, listSettingsHistory, kvGet, kvSet, db, loadCandles, saveCandles } from '../db.js';
-import { PLANS, effectivePlan, publicUser, getUserById, createSession, deleteSession, registerUser, loginUser, ensureNotifyCode, ensureApiKey, getUserByApiKey, activateLocalLicense, listAllUsers, setUserPlan, createOrUpdateAdminUser, createPromoCode, listPromoCodes, redeemPromoCode, acceptUserOffer, createVipRequest, listVipRequests, parseCookies, parseAllCookieValues, publicOAuthConfig, saveOAuthConfig, startOAuthRedirect, completeOAuthCallback, verifyTelegramLoginWidget } from '../auth/index.js';
-import { publicBillingConfig, saveBillingConfig, createYookassaPayment, verifyYookassaPayment, verifyUserLatestPayment, listAllPayments, listUserPayments } from '../billing/yookassa.js';
-import { publicNotifyConfig, getNotifyConfig, saveNotifyConfig, notifyUser, createTelegramLoginChallenge, checkTelegramLoginChallenge, handleMaxWebhook } from '../notify/index.js';
-import { PARAMS } from '../params-meta.js';
-import { getSettings, updateSettings, resetSettings, revertSettingsChange } from '../settings.js';
-import { startModelResearch, cancelModelResearch, startStabilityCheck, cancelStabilityCheck } from '../model/research.js';
-import { forecastNow, TIER1_LIQUID_SYMBOLS, symbolEdgeMult } from '../model/forecast.js';
-import { profilesInfo, startProfilesRefresh, TRAITS, loadProfiles } from '../model/profiles.js';
-import { ensureDividends, ensureCandles } from '../data/moex.js';
-import { live } from '../model/live.js';
-import { brokersState, saveBrokerAccount, deleteBrokerAccount, syncBrokerAccount, discoverBrokerAccounts, freezeBrokerBaseline, fetchBrokerHistory, prepareBrokerOrders, executeBrokerOrders, rejectBrokerOrders, cancelBrokerOrder, triggerBrokerFastEntryCheck, ensureBoardSpecs, resetBrokerDailyStop, listBrokerEvents, listTradeDecisions, stopAllBrokerTrading, fetchTbankCandles } from '../brokers/index.js';
-import { listNews } from '../news/index.js';
-import * as strategist from '../strategist/index.js';
-import { round, MSK, DAY } from '../util.js';
-import { hub } from '../hub.js';
-import { isCrossOrigin } from '../security.js';
-import { IS_CENTRAL, IS_INSTANCE, CENTRAL_URL, clientIp, isHttpsRequest } from '../role.js';
-import { consumeSsoToken } from '../instance/agent.js';
-import { IS_DESKTOP } from '../role.js';
-import { listInstances, createInstance, rotateInstanceKey, setInstanceTrading, setInstanceRevoked, deleteInstance, instanceByKey, instanceHeartbeat, cabinetInstances, ensureUserCloudInstance, ssoRedirectUrl, relayInstanceNotify, centralPublicKeyPem, createDesktopActivationCode, activateDesktopInstall, unbindInstall } from '../instance/central.js';
-import { activateDesktop, instanceInfo } from '../instance/agent.js';
-import { isActivated } from '../instance/identity.js';
-
-export function createRouter() {
-  const r = express.Router();
-  const wrap = (fn) => (req, res) => Promise.resolve().then(() => fn(req, res)).catch((e) => res.status(e.status || 400).json({ error: e.message }));
-
-  // ---------- общая защита API: вход обязателен везде, кроме публичных маршрутов ----------
-  const PUBLIC_API = [/^\/config$/, /^\/auth\//, /^\/license\/verify$/, /^\/billing\/yookassa\/webhook$/, /^\/notify\/max\/webhook$/, /^\/public\//, /^\/llm\/proxy\//, /^\/instance\//, /^\/instances\/open$/, /^\/local\//];
-  // внешние серверные вызовы без браузерного Origin-контроля
-  const MACHINE_API = [/^\/license\/verify$/, /^\/billing\/yookassa\/webhook$/, /^\/notify\/max\/webhook$/, /^\/llm\/proxy\//, /^\/instance\//];
-  // На машине клиента регистрация, вход по паролю, оплата, админка, боты и ИИ-прокси живут только в центре
-  const CENTRAL_ONLY_API = [/^\/auth\/(register|login|oauth|telegram|notify-code|notify-test|redeem-promo|vip-request|api-key|accept-offer)/, /^\/billing\//, /^\/admin\//, /^\/license\//, /^\/llm\/proxy\//, /^\/notify\//, /^\/public\/showcase$/, /^\/instance\//, /^\/instances\//];
-  r.use((req, res, next) => {
-    const p = req.path;
-    if (IS_INSTANCE && CENTRAL_ONLY_API.some((rx) => rx.test(p))) {
-      return res.status(404).json({ error: `Доступно в личном кабинете: ${CENTRAL_URL}` });
-    }
-    if (!IS_CENTRAL && (/^\/instance\//.test(p) || /^\/instances\//.test(p) || /^\/admin\/instances/.test(p))) {
-      return res.status(404).json({ error: 'Доступно только на центральном сервере' });
-    }
-    if (!IS_INSTANCE && /^\/local\//.test(p)) {
-      return res.status(404).json({ error: 'Доступно только на машине клиента' });
-    }
-    const isRead = req.method === 'GET' || req.method === 'HEAD' || req.method === 'OPTIONS';
-    if (!isRead && !MACHINE_API.some((rx) => rx.test(p)) && isCrossOrigin(req)) {
-      return res.status(403).json({ error: 'Запрос с чужого сайта отклонён' });
-    }
-    if (req.user || PUBLIC_API.some((rx) => rx.test(p))) return next();
-    return res.status(401).json({ error: 'Требуется вход в аккаунт' });
-  });
-
-  r.get('/config', (req, res) => res.json({
-    defaults: strategyDefaults, params: PARAMS,
-    llm: activeModelInfo(),
-    user: publicUser(req.user),
-    cloudMode: process.env.CLOUD_MODE === '1',
-    plans: PLANS,
-    notify: publicNotifyConfig(),
-    billing: { enabled: publicBillingConfig().enabled },
-  }));
-
-  // ---------- авторизация, профиль и тарифы ----------
-  const setCookie = (res, sid, maxAgeSec = 30 * 86400) => {
-    const secure = isHttpsRequest(res.req) ? '; Secure' : '';
-    res.setHeader('Set-Cookie', `sid=${encodeURIComponent(sid)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${maxAgeSec}${secure}`);
-  };
-  const isRuSegmentRequest = (req) => {
-    if (process.env.ALLOW_FOREIGN_AUTH === '1') return false;
-    const country = String(req.headers?.['cf-ipcountry'] || req.headers?.['x-country-code'] || req.headers?.['x-geo-country'] || '').trim().toUpperCase();
-    if (country) return country === 'RU';
-    const lang = String(req.headers?.['accept-language'] || '').toLowerCase();
-    if (lang && !lang.includes('ru')) return false;
-    return true;
-  };
-  r.get('/auth/me', (req, res) => res.json({
-    user: req.user ? { ...publicUser(req.user), instances: IS_CENTRAL ? cabinetInstances(req.user.id) : [], payments: listUserPayments(req.user.id, 15) } : null,
-    downloads: IS_CENTRAL ? {
-      windows: process.env.DESKTOP_DOWNLOAD_WINDOWS || '',
-      linux: process.env.DESKTOP_DOWNLOAD_LINUX || '',
-      docker: process.env.DESKTOP_DOCKER_IMAGE || '',
-    } : null,
-    role: IS_INSTANCE ? 'instance' : IS_CENTRAL ? 'central' : 'dev',
-    centralUrl: IS_INSTANCE ? CENTRAL_URL : '',
-    cloudMode: process.env.CLOUD_MODE === '1',
-    isRuSegment: isRuSegmentRequest(req),
-    plans: PLANS,
-    notify: publicNotifyConfig(),
-    oauth: publicOAuthConfig(),
-    billing: { enabled: publicBillingConfig().enabled },
-  }));
-  r.get('/auth/oauth/:provider/start', (req, res) => {
-    try {
-      const origin = `${req.protocol}://${req.get('host')}`;
-      const url = startOAuthRedirect(req.params.provider, { origin, plan: req.query.plan || '' });
-      res.redirect(url);
-    } catch (e) {
-      res.redirect(`/landing?oauth_error=${encodeURIComponent(e.message)}`);
-    }
-  });
-  r.get('/auth/oauth/:provider/callback', async (req, res) => {
-    try {
-      const { user, plan } = await completeOAuthCallback(req.params.provider, req.query || {});
-      const token = createSession(user.id);
-      setCookie(res, token);
-      res.redirect(`/landing?oauth_ok=1${plan ? `&buy_plan=${encodeURIComponent(plan)}` : ''}`);
-    } catch (e) {
-      res.redirect(`/landing?oauth_error=${encodeURIComponent(e.message)}`);
-    }
-  });
-  r.get('/auth/telegram/callback', (req, res) => {
-    try {
-      const { tgToken } = getNotifyConfig();
-      const user = verifyTelegramLoginWidget(req.query || {}, tgToken);
-      const token = createSession(user.id);
-      setCookie(res, token);
-      res.redirect('/landing?oauth_ok=1');
-    } catch (e) {
-      res.redirect(`/landing?oauth_error=${encodeURIComponent(e.message)}`);
-    }
-  });
-  // Быстрый вход в 1 клик через бота Telegram или MAX
-  r.post('/auth/telegram/start', wrap((req, res) => {
-    const ch = req.body?.channel === 'max' ? 'max' : 'tg';
-    const nt = publicNotifyConfig();
-    if (ch === 'max') {
-      if (!nt.hasMaxToken || !nt.maxBotName) throw new Error('Бот MAX ещё не подключён администратором');
-      const code = createTelegramLoginChallenge();
-      return res.json({ code, botUrl: `https://max.ru/${encodeURIComponent(nt.maxBotName)}?start=${encodeURIComponent(code)}` });
-    }
-    if (!nt.hasTgToken || !nt.tgBotName) throw new Error('Telegram-бот ещё не подключён администратором');
-    const code = createTelegramLoginChallenge();
-    res.json({ code, botUrl: `https://t.me/${encodeURIComponent(nt.tgBotName)}?start=${encodeURIComponent(code)}` });
-  }));
-  r.get('/auth/telegram/poll', (req, res) => {
-    const st = checkTelegramLoginChallenge(req.query.code);
-    if (st.status === 'done' && st.userId) {
-      const u = getUserById(st.userId);
-      const token = createSession(u.id);
-      setCookie(res, token);
-      return res.json({ status: 'done', user: publicUser(u), token });
-    }
-    res.json(st);
-  });
-  r.post('/auth/register', wrap((req, res) => {
-    const u = registerUser(req.body || {});
-    const token = createSession(u.id);
-    setCookie(res, token);
-    res.json({ user: publicUser(u), token });
-  }));
-  r.post('/auth/login', wrap(async (req, res) => {
-    const u = await loginUser(req.body || {}, { ip: clientIp(req) });
-    const token = createSession(u.id);
-    setCookie(res, token);
-    res.json({ user: publicUser(u), token });
-  }));
-  r.post('/auth/logout', (req, res) => {
-    for (const tok of parseAllCookieValues(req.headers?.cookie, 'sid')) {
-      if (tok && tok !== 'logged_out') deleteSession(tok);
-    }
-    setCookie(res, 'logged_out', 365 * 86400);
-    res.json({ ok: true, ...(IS_INSTANCE ? { redirect: CENTRAL_URL } : {}) });
-  });
-
-  // ---------- установка на компьютер: состояние и активация кодом (до активации входа ещё нет) ----------
-  r.get('/local/status', (req, res) => res.json({ ...instanceInfo(), loggedIn: Boolean(req.user) }));
-  r.post('/local/activate', wrap(async (req, res) => {
-    if (!IS_DESKTOP) throw new Error('Активация кодом доступна только для установки на компьютер');
-    if (isActivated() && !req.user) throw Object.assign(new Error('Программа уже активирована'), { status: 409 });
-    res.json(await activateDesktop(req.body?.code));
-  }));
-
-  // ---------- машина клиента: вход по одноразовой ссылке из кабинета центра ----------
-  r.get('/auth/sso', (req, res) => {
-    if (!IS_INSTANCE) return res.status(404).json({ error: 'Вход через центр доступен только на машине клиента' });
-    try {
-      consumeSsoToken(String(req.query.t || ''));
-      const token = createSession(1, 7);
-      setCookie(res, token, 7 * 86400);
-      res.redirect('/');
-    } catch (e) {
-      res.redirect(`${CENTRAL_URL}/landing?oauth_error=${encodeURIComponent(e.message)}`);
-    }
-  });
-
-  // ---------- центр: связь с машинами клиентов ----------
-  const machineAuth = (req) => {
-    const h = String(req.headers?.authorization || '');
-    const inst = instanceByKey(h.startsWith('Bearer ') ? h.slice(7).trim() : '');
-    if (!inst) throw Object.assign(new Error('Неизвестная машина или неверный ключ'), { status: 401 });
-    return inst;
-  };
-  r.post('/instance/heartbeat', wrap((req, res) => res.json(instanceHeartbeat(machineAuth(req), req.body || {}))));
-  // Активация установки на компьютер одноразовым кодом из кабинета (ключа у установки ещё нет)
-  r.post('/instance/activate', wrap((req, res) => res.json(activateDesktopInstall(req.body || {}, { ip: clientIp(req) }))));
-  // Кабинет клиента: код активации для установки на компьютер и отвязка компьютера
-  r.post('/instances/desktop-code', wrap((req, res) => res.json(createDesktopActivationCode(req.user))));
-  r.post('/instances/:id/unbind', wrap((req, res) => res.json({ instance: unbindInstall(req.params.id, { userId: req.user.id }) })));
-  r.post('/instance/notify', wrap(async (req, res) => {
-    const inst = machineAuth(req);
-    if (inst.revoked) throw Object.assign(new Error('Аренда машины завершена'), { status: 403 });
-    res.json(await relayInstanceNotify(inst, req.body?.text, req.body?.buttons));
-  }));
-  // Кнопка «Открыть терминал» в кабинете: одноразовая подписанная ссылка входа на машину клиента
-  r.get('/instances/open', (req, res) => {
-    if (!req.user) return res.redirect('/landing?login=1');
-    const url = ssoRedirectUrl(req.user, req.query.i || '');
-    if (!url) return res.redirect(`/landing?oauth_error=${encodeURIComponent('Для вашего аккаунта ещё не создана машина — обратитесь в поддержку')}`);
-    res.redirect(url);
-  });
-  r.get('/public/license-key', (req, res) => {
-    if (!IS_CENTRAL) return res.status(404).json({ error: 'Только на центральном сервере' });
-    res.type('text/plain').send(centralPublicKeyPem());
-  });
-  r.post('/auth/notify-code', wrap((req, res) => {
-    if (!req.user) throw new Error('Войдите в аккаунт');
-    const code = ensureNotifyCode(req.user.id);
-    res.json({ code, notify: publicNotifyConfig() });
-  }));
-  r.post('/auth/notify-test', wrap(async (req, res) => {
-    if (!req.user) throw new Error('Войдите в аккаунт');
-    const sent = await notifyUser(req.user.id, 'НейроАльфа: тестовое уведомление успешно доставлено.');
-    if (!sent.tg && !sent.max) throw new Error('Сначала привяжите Telegram или MAX по вашему коду привязки');
-    res.json({ ok: true, ...sent });
-  }));
-  r.post('/auth/redeem-promo', wrap(async (req, res) => {
-    if (!req.user) throw new Error('Войдите в аккаунт для активации кода или VIP-токена');
-    const user = redeemPromoCode(req.user.id, req.body?.code);
-    if (IS_CENTRAL) await ensureUserCloudInstance(req.user.id).catch(() => {});
-    res.json({ user: { ...user, instances: IS_CENTRAL ? cabinetInstances(req.user.id) : [], payments: listUserPayments(req.user.id, 15) } });
-  }));
-  r.post('/auth/accept-offer', wrap((req, res) => {
-    if (!req.user) throw new Error('Войдите в аккаунт');
-    res.json({ ok: true, user: acceptUserOffer(req.user.id) });
-  }));
-  r.post('/auth/vip-request', wrap(async (req, res) => {
-    const item = createVipRequest({ user: req.user, ...(req.body || {}) });
-    notifyUser(1, `👑 Заявка на тариф VIP (НейроАльфа):\nИмя: ${item.name}\nКонтакт: ${item.contact || item.email}\nКапитал: ${item.capitalRub || '—'}\nКомментарий: ${item.comment || '—'}`).catch(() => {});
-    res.json({ ok: true, request: item });
-  }));
-  r.post('/auth/api-key/regenerate', wrap((req, res) => {
-    if (!req.user) throw new Error('Войдите в аккаунт');
-    const apiKey = ensureApiKey(req.user.id, true);
-    res.json({ apiKey, user: publicUser({ ...req.user, api_key: apiKey }) });
-  }));
-  // Проверка API-ключа внешним npx-клиентом
-  r.post('/license/verify', wrap((req, res) => {
-    const authHeader = String(req.headers?.authorization || '');
-    const key = String(req.body?.apiKey || (authHeader.startsWith('Bearer ') ? authHeader.slice(7) : '') || '').trim();
-    const u = getUserByApiKey(key);
-    if (!u) return res.status(401).json({ valid: false, error: 'Неверный или отозванный API-ключ' });
-    const p = effectivePlan(u);
-    res.json({
-      valid: true,
-      email: u.email,
-      name: u.name,
-      plan: p.id,
-      planName: p.name,
-      planUntil: u.plan_until || 0,
-      limits: p,
-    });
-  }));
-  // Активация API-ключа облачной подписки на локальном npx-клиенте
-  r.post('/license/activate', wrap(async (req, res) => {
-    requireAdmin(req);
-    const lic = await activateLocalLicense(req.body?.apiKey, req.body?.cloudUrl);
-    llmChanged();
-    res.json({ ok: true, license: lic, user: publicUser(req.user) });
-  }));
-
-  // ---------- оплата через ЮKassa ----------
-  r.post('/billing/checkout', wrap(async (req, res) => {
-    const origin = `${req.protocol}://${req.get('host')}`;
-    res.json(await createYookassaPayment({
-      user: req.user,
-      plan: req.body?.plan,
-      months: req.body?.months || 1,
-      returnOrigin: req.body?.returnOrigin || origin,
-    }));
-  }));
-  r.post('/billing/verify', wrap(async (req, res) => {
-    if (!req.user) throw new Error('Войдите в аккаунт');
-    const out = req.body?.paymentId
-      ? await verifyYookassaPayment(req.body.paymentId)
-      : await verifyUserLatestPayment(req.user.id);
-    if (IS_CENTRAL && out?.status === 'succeeded') {
-      await ensureUserCloudInstance(req.user.id).catch(() => {});
-    }
-    res.json({
-      ...out,
-      user: out?.user ? { ...out.user, instances: IS_CENTRAL ? cabinetInstances(req.user.id) : [], payments: listUserPayments(req.user.id, 15) } : null,
-    });
-  }));
-  r.post('/billing/yookassa/webhook', wrap(async (req, res) => {
-    const pid = req.body?.object?.id;
-    if (pid) {
-      const out = await verifyYookassaPayment(pid).catch(() => null);
-      if (IS_CENTRAL && out?.status === 'succeeded' && out?.user?.id) {
-        await ensureUserCloudInstance(out.user.id).catch(() => {});
-      }
-    }
-    res.json({ ok: true });
-  }));
-  r.post('/notify/max/webhook', wrap(async (req, res) => {
-    res.json(await handleMaxWebhook(req.body || {}, req.headers || {}));
-  }));
-
-  // ---------- публичная витрина для лендинга ----------
-  r.get('/public/showcase', (req, res) => {
-    const buildShowcaseItem = (x, full) => {
-      const chosen = x.metrics?.model?.chosen || 'attention';
-      const cmpFull = x.metrics?.model?.comparison?.[chosen]?.full || full?.extra?.comparison?.[chosen]?.full || {};
-      const mFull = { ...(x.metrics?.full || {}), ...cmpFull };
-      const p = x.params || {};
-      const dir = p.modelDirection || 'long';
-      const topK = p.modelTopK || 2;
-      const from = x.metrics?.period?.from || 0, till = x.metrics?.period?.till || 0;
-      const yrs = Math.max(0.5, (till - from) / (365.25 * 86400000));
-      const ret = Number(mFull.returnPct || 0);
-      const cagr = yrs >= 0.25 && ret > -99 ? ((Math.pow(1 + ret / 100, 1 / yrs) - 1) * 100) : (ret / yrs);
-
-      let tierBadge = 'Тариф «Инвестор»';
-      let tierColor = 'blue';
-      // Тарифы различаются возможностями (шорты, число счетов, лимиты), а не доходностью
-      let tierNote = 'Только покупки (без шорта) · 1 счёт до 1 млн ₽';
-      let autoTitle = p._title;
-      if (dir === 'long') {
-        tierBadge = 'Для тарифа «Инвестор»';
-        tierColor = 'blue';
-        if (!autoTitle) autoTitle = 'Только покупки';
-      } else {
-        tierBadge = 'Для тарифов «Профи» и «VIP»';
-        tierColor = 'indigo';
-        tierNote = 'Покупки и продажи без покрытия (шорт) · до 5 счетов';
-        if (!autoTitle || autoTitle === 'Эталонная адаптивная стратегия' || /форсаж|мощность/i.test(autoTitle)) autoTitle = 'Покупки и шорты';
-      }
-      void cagr;
-      return {
-        id: x.id,
-        title: autoTitle,
-        tierBadge,
-        tierColor,
-        tierNote,
-        params: { modelHorizon: p.modelHorizon || 2.5, modelTopK: topK, modelDirection: dir, modelType: chosen },
-        metrics: mFull,
-        oos: x.metrics?.model?.comparison?.[chosen]?.outOfSample || full?.extra?.comparison?.[chosen]?.outOfSample || {},
-        period: x.metrics?.period || {},
-        curve: full?.extra?.curves?.[chosen]?.slice(-180) || [],
-        marketCurve: full?.extra?.curves?.market?.slice(-180) || [],
-        // реалистичная оценка стресс-теста (исполнение как в живом контуре, издержки 0,10% на сторону)
-        realistic: (() => {
-          const s = (full?.extra?.stress || x.extra?.stress)?.scenarios?.find((y) => y.key === 'liveLike10');
-          return s ? { returnPct: s.full.returnPct, cagrPct: s.full.cagrPct, profitFactor: s.full.profitFactor, maxDrawdownPct: s.full.maxDrawdownPct, last12Pct: s.last12.returnPct } : null;
-        })(),
-      };
-    };
-    const runs = listShowcaseRuns().map((x) => buildShowcaseItem(x, getRun(x.id)));
-    if (!runs.length) {
-      try {
-        const ref = JSON.parse(fs.readFileSync(path.join(ROOT, 'config', 'seed-run.json'), 'utf8'));
-        if (ref) runs.push(buildShowcaseItem({ id: 1, ...ref }, ref));
-      } catch { /* ignore */ }
-    }
-    res.json({ runs, plans: PLANS, legal: getLegalInfo() });
-  });
-
-  // ---------- реквизиты оферты (для модерации ЮKassa и правовых документов) ----------
-  const DEFAULT_LEGAL = {
-    ownerName: 'ООО «БИС» («Бизнес Интер Софт»)',
-    authorName: 'Перепелкин Роман Александрович',
-    status: 'Оператор платформы PaaS · Проприетарное ПО (Все права защищены)',
-    inn: '',
-    ogrn: '',
-    email: 'support@neuroalpha.ru',
-    phone: '',
-    address: 'Российская Федерация, г. Рязань',
-  };
-  const getLegalInfo = () => ({ ...DEFAULT_LEGAL, ...(kvGet('legalInfo') || {}) });
-  r.get('/public/legal', (req, res) => res.json(getLegalInfo()));
-
-  // ---------- админ-панель (пользователи, оплаты, ЮKassa, боты Telegram и MAX, витрина, реквизиты) ----------
-  const requireAdmin = (req) => {
-    if (!req.user || req.user.role !== 'admin') throw Object.assign(new Error('Доступно только администратору платформы'), { status: 403 });
-  };
-  r.get('/admin/state', wrap((req, res) => {
-    requireAdmin(req);
-    res.json({ users: listAllUsers(), payments: listAllPayments(), promos: listPromoCodes(), vipRequests: listVipRequests(), billing: publicBillingConfig(), notify: publicNotifyConfig(), oauth: publicOAuthConfig(), legal: getLegalInfo() });
-  }));
-  r.post('/admin/oauth', wrap((req, res) => {
-    requireAdmin(req);
-    res.json({ ok: true, oauth: saveOAuthConfig(req.body || {}) });
-  }));
-  r.post('/admin/legal', wrap((req, res) => {
-    requireAdmin(req);
-    const b = req.body || {};
-    const next = {
-      ownerName: String(b.ownerName ?? '').trim(),
-      status: String(b.status ?? '').trim(),
-      inn: String(b.inn ?? '').trim(),
-      ogrn: String(b.ogrn ?? '').trim(),
-      email: String(b.email ?? '').trim(),
-      phone: String(b.phone ?? '').trim(),
-      address: String(b.address ?? '').trim(),
-    };
-    kvSet('legalInfo', next);
-    res.json({ ok: true, legal: getLegalInfo() });
-  }));
-  r.post('/admin/promo', wrap((req, res) => {
-    requireAdmin(req);
-    res.json({ promos: createPromoCode(req.body || {}) });
-  }));
-  r.post('/admin/user-plan', wrap(async (req, res) => {
-    requireAdmin(req);
-    const user = setUserPlan(req.body?.userId, req.body?.plan, req.body?.days || 30);
-    if (IS_CENTRAL) await ensureUserCloudInstance(req.body?.userId).catch(() => {});
-    res.json({ user, users: listAllUsers() });
-  }));
-  r.post('/admin/create-admin', wrap((req, res) => {
-    requireAdmin(req);
-    res.json({ user: createOrUpdateAdminUser(req.body || {}), users: listAllUsers() });
-  }));
-  r.post('/admin/billing', wrap((req, res) => {
-    requireAdmin(req);
-    res.json(saveBillingConfig(req.body || {}));
-  }));
-  r.post('/admin/notify', wrap(async (req, res) => {
-    requireAdmin(req);
-    res.json(await saveNotifyConfig(req.body || {}));
-  }));
-  // ---------- машины клиентов (аренда ПО + машина + ИИ, лицензия под контролем центра) ----------
-  const centralUrlOf = (req) => String(process.env.CENTRAL_PUBLIC_URL || `${isHttpsRequest(req) ? 'https' : req.protocol}://${req.get('host')}`).replace(/\/+$/, '');
-  r.get('/admin/instances', wrap((req, res) => { requireAdmin(req); res.json({ instances: listInstances() }); }));
-  r.post('/admin/instances', wrap(async (req, res) => {
-    requireAdmin(req);
-    res.json(await createInstance(req.body || {}, { centralUrl: centralUrlOf(req) }));
-  }));
-  r.post('/admin/instances/:id/rotate-key', wrap(async (req, res) => { requireAdmin(req); res.json(await rotateInstanceKey(req.params.id, { centralUrl: centralUrlOf(req) })); }));
-  r.post('/admin/instances/:id/trading', wrap((req, res) => { requireAdmin(req); res.json({ instance: setInstanceTrading(req.params.id, String(req.body?.trading || '')) }); }));
-  r.post('/admin/instances/:id/revoke', wrap((req, res) => { requireAdmin(req); res.json({ instance: setInstanceRevoked(req.params.id, req.body?.revoked !== false) }); }));
-  r.post('/admin/instances/:id/unbind', wrap((req, res) => { requireAdmin(req); res.json({ instance: unbindInstall(req.params.id) }); }));
-  r.delete('/admin/instances/:id', wrap(async (req, res) => { requireAdmin(req); res.json({ instances: await deleteInstance(req.params.id) }); }));
-  r.put('/runs/:id/showcase', wrap((req, res) => {
-    requireAdmin(req);
-    res.json(setRunShowcase(Number(req.params.id), Boolean(req.body?.showcase)));
-  }));
-
-  // ---------- модели ИИ ----------
-  const llmState = () => ({ providers: listProviders(), selected: getSelected(), active: activeModelInfo() });
-  const llmChanged = () => {
-    hub.emit({ type: 'llm:changed', llm: activeModelInfo() });
-    hub.emit({ type: 'chat:state', state: strategist.chatState() });
-  };
-  // Подключения к LLM общие для всей платформы (ключи, адреса), поэтому менять и проверять их может только администратор
-  r.get('/llm/providers', wrap((req, res) => res.json(llmState())));
-  r.post('/llm/providers', wrap((req, res) => { requireAdmin(req); const p = addProvider(req.body); llmChanged(); res.json({ provider: p, ...llmState() }); }));
-  r.put('/llm/providers/:id', wrap((req, res) => { requireAdmin(req); const p = updateProvider(req.params.id, req.body); llmChanged(); res.json({ provider: p, ...llmState() }); }));
-  r.delete('/llm/providers/:id', wrap((req, res) => { requireAdmin(req); deleteProvider(req.params.id); llmChanged(); res.json(llmState()); }));
-  r.get('/llm/providers/:id/remote-models', wrap(async (req, res) => { requireAdmin(req); res.json({ models: await fetchRemoteModels(req.params.id) }); }));
-  r.post('/llm/test', wrap(async (req, res) => { requireAdmin(req); res.json(await testProvider(req.body?.providerId, req.body?.model)); }));
-  r.post('/llm/select', wrap((req, res) => { requireAdmin(req); selectModel(req.body?.providerId, req.body?.model); llmChanged(); res.json(llmState()); }));
-
-  // ---------- облачный ИИ-прокси для локальных npx-клиентов по APIKey или в демо-режиме ----------
-  const proxyUsesToday = (ident) => {
-    const day = new Date().toISOString().slice(0, 10);
-    const key = `llmProxy:${ident}:${day}`;
-    return { key, count: Number(kvGet(key, 0)) || 0 };
-  };
-  r.get('/llm/proxy/v1/models', (req, res) => {
-    res.json({ data: [{ id: 'Qwen/Qwen3.8-27B-FP8', object: 'model' }] });
-  });
-  r.post('/llm/proxy/v1/chat/completions', async (req, res) => {
-    try {
-      const ip = String(req.headers['x-forwarded-for'] || req.socket?.remoteAddress || 'anon').split(',')[0].trim();
-      let maxPerDay = 5;
-      let ident = `ip:${ip}`;
-      let planLabel = 'Демо (без ключа)';
-      if (req.user) {
-        const plan = effectivePlan(req.user);
-        maxPerDay = plan.maxChatPerDay;
-        ident = `u:${req.user.id}`;
-        planLabel = plan.name;
-      }
-      const u = proxyUsesToday(ident);
-      if (u.count >= maxPerDay) {
-        return res.status(429).json({
-          error: {
-            message: req.user
-              ? `Исчерпан дневной лимит ИИ-запросов по тарифу «${planLabel}» (${maxPerDay} в сутки). Расширьте тариф на https://neuroalpha.odant.org`
-              : `Исчерпан бесплатный демо-лимит (${maxPerDay} запросов в сутки). Получите бесплатный или платный APIKey на https://neuroalpha.odant.org`,
-          },
-        });
-      }
-      const t = resolveUpstreamForProxy();
-      if (!t) {
-        return res.status(503).json({ error: { message: 'На сервере neuroalpha.odant.org ещё не подключена апстрим-модель ИИ' } });
-      }
-      kvSet(u.key, u.count + 1);
-      const body = { ...(req.body || {}), model: t.model, stream: true };
-      if (!body.reasoning_effort && t.effort) body.reasoning_effort = t.effort;
-      const upstream = await providerFetch(t.provider, t.url, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', Accept: 'text/event-stream' },
-        body: JSON.stringify(body),
-        signal: AbortSignal.timeout(90000),
-      });
-      if (!upstream.ok) {
-        const txt = await upstream.text().catch(() => '');
-        return res.status(upstream.status).json({ error: { message: txt.slice(0, 300) || `HTTP ${upstream.status}` } });
-      }
-      res.setHeader('Content-Type', 'text/event-stream; charset=utf-8');
-      res.setHeader('Cache-Control', 'no-cache');
-      res.setHeader('Connection', 'keep-alive');
-      for await (const chunk of upstream.body) {
-        res.write(chunk);
-      }
-      res.end();
-    } catch (e) {
-      if (!res.headersSent) res.status(500).json({ error: { message: e.message } });
-      else res.end();
-    }
-  });
-
-  // ---------- настройки ----------
-  r.get('/settings', (req, res) => res.json(getSettings()));
-  r.put('/settings', wrap((req, res) => res.json(updateSettings(req.body || {}, { source: 'user' }))));
-  r.post('/settings/reset', (req, res) => res.json(resetSettings('user')));
-  r.get('/settings/history', (req, res) => res.json(listSettingsHistory(Math.min(200, Number(req.query.limit) || 50))));
-  r.post('/settings/history/:id/revert', wrap((req, res) => res.json(revertSettingsChange(req.params.id))));
-
-  // ---------- исследования ----------
-  const ownsRun = (req, run) => Boolean(run && req.user && (req.user.role === 'admin' || (run.user_id ?? 1) === req.user.id));
-  const ownRunOr404 = (req) => {
-    const run = getRun(Number(req.params.id));
-    if (!ownsRun(req, run)) throw Object.assign(new Error('Не найдено'), { status: 404 });
-    return run;
-  };
-  r.get('/runs', (req, res) => res.json(listRuns()));
-  r.get('/runs/:id', (req, res) => {
-    const run = getRun(Number(req.params.id));
-    if (!run || !(ownsRun(req, run) || run.showcase)) return res.status(404).json({ error: 'Не найдено' });
-    res.json({ ...run, trades: getTrades(run.id) });
-  });
-  r.put('/runs/:id/title', wrap((req, res) => {
-    ownRunOr404(req);
-    const updated = updateRunTitle(Number(req.params.id), req.body?.title || '');
-    if (!updated) return res.status(404).json({ error: 'Не найдено' });
-    res.json(updated);
-  }));
-  r.post('/runs/:id/stability', wrap((req, res) => { ownRunOr404(req); res.json(startStabilityCheck(Number(req.params.id))); }));
-  r.post('/runs/:id/stability/cancel', wrap((req, res) => { ownRunOr404(req); res.json({ ok: cancelStabilityCheck(Number(req.params.id)) }); }));
-  r.delete('/runs/:id', wrap((req, res) => {
-    const run = ownRunOr404(req);
-    if (run?.status === 'running') throw new Error('Эксперимент ещё идёт — сначала отмените его');
-    deleteRun(Number(req.params.id));
-    res.json({ ok: true });
-  }));
-  // Очистка истории прогонов: оставить ровно keep лучших по итогу (0 — удалить все завершённые), идущие не трогать
-  r.post('/runs/cleanup', wrap((req, res) => {
-    const raw = Number(req.body?.keep);
-    const keep = Number.isFinite(raw) ? Math.max(0, Math.min(50, Math.floor(raw))) : 0;
-    const all = allRuns();
-    const done = all.filter((r) => r.mode === 'model' && r.status === 'done');
-    const ranked = [...done].sort((a, b) => (b.metrics?.full?.returnPct ?? -1e9) - (a.metrics?.full?.returnPct ?? -1e9));
-    const keepSet = new Set(ranked.slice(0, keep).map((r) => r.id));
-    let deleted = 0;
-    for (const r of all) {
-      if (r.mode !== 'model' || r.status === 'running' || keepSet.has(r.id)) continue;
-      deleteRun(r.id);
-      deleted++;
-    }
-    res.json({ deleted, kept: [...keepSet] });
-  }));
-
-  r.post('/model/research', wrap((req, res) => {
-    const plan = effectivePlan(req.user);
-    if (!plan.allowResearch && req.user?.role !== 'admin') {
-      throw new Error('Раздел исследований доступен только в режиме «Хозяин».');
-    }
-    if (countUserRunsToday() >= plan.maxRunsPerDay) {
-      throw new Error(`Достигнут дневной лимит исследований (${plan.maxRunsPerDay} в сутки).`);
-    }
-    const body = req.body || {};
-    const merged = { ...getSettings(), ...body };
-    const { runId, reused } = startModelResearch(merged, { source: 'user', force: !!body.force });
-    res.json({ runId, reused: !!reused });
-  }));
-  r.post('/model/:id/cancel', wrap((req, res) => { ownRunOr404(req); res.json({ ok: cancelModelResearch(Number(req.params.id)) }); }));
-  r.get('/model/forecast', wrap(async (req, res) => {
-    const fc = await forecastNow(getSettings(), { force: req.query.force === '1' });
-    if (fc?.rows?.some((x) => x.signal || x.shortSignal)) {
-      triggerBrokerFastEntryCheck();
-    }
-    res.json(fc);
-  }));
-
-  // ---------- описания компаний (текстовая карта) ----------
-  r.get('/profiles', wrap(async (req, res) => res.json(await profilesInfo())));
-  r.post('/profiles/refresh', wrap((req, res) => res.json(startProfilesRefresh())));
-
-  // ---------- живая проверка (несколько виртуальных счетов) ----------
-  r.get('/live/status', (req, res) => res.json(live.status()));
-  r.post('/live/start', wrap(async (req, res) => {
-    const plan = effectivePlan(req.user);
-    const b = req.body || {};
-    const runId = await live.start(getSettings(), { source: 'user', baseRunId: b.baseRunId || null, name: b.name || '', capital: b.capital || null, maxAccounts: plan.maxVirtualAccounts });
-    res.json({ runId, status: live.status() });
-  }));
-  r.post('/live/stop', (req, res) => res.json({ ok: live.stop(req.body?.runId || null), status: live.status() }));
-  r.delete('/live/:id', (req, res) => res.json({ ok: live.remove(Number(req.params.id)), status: live.status() }));
-
-  // ---------- брокерские счета (Т-Банк, Финам, Алор, БКС) ----------
-  r.get('/brokers', (req, res) => res.json(brokersState()));
-  r.post('/brokers/discover', wrap(async (req, res) => res.json(await discoverBrokerAccounts(req.body || {}))));
-  r.post('/brokers', wrap((req, res) => {
-    const plan = effectivePlan(req.user);
-    const cur = brokersState().accounts.length;
-    if (!req.body?.id && cur >= plan.maxBrokerAccounts) {
-      if ((plan.maxBrokerAccounts ?? 0) < 1) {
-        throw new Error('Для подключения брокерского счёта оформите подписку «Инвестор» (3 900 ₽/мес), «Профи» (9 900 ₽/мес) или «VIP».');
-      }
-      throw new Error(`По вашему тарифу «${plan.name}» доступно подключение до ${plan.maxBrokerAccounts} брокерских счетов. Перейдите на тариф «Профи» или «VIP».`);
-    }
-    res.json(saveBrokerAccount(req.body || {}));
-  }));
-  r.put('/brokers/:id', wrap((req, res) => res.json(saveBrokerAccount({ ...(req.body || {}), id: req.params.id }))));
-  r.delete('/brokers/:id', wrap((req, res) => res.json(deleteBrokerAccount(req.params.id))));
-  r.post('/brokers/:id/sync', wrap(async (req, res) => res.json(await syncBrokerAccount(req.params.id))));
-  r.post('/brokers/:id/history', wrap(async (req, res) => res.json(await fetchBrokerHistory(req.params.id, req.body || {}))));
-  r.post('/brokers/:id/freeze-baseline', wrap(async (req, res) => res.json(await freezeBrokerBaseline(req.params.id))));
-  r.post('/brokers/:id/prepare', wrap(async (req, res) => res.json(await prepareBrokerOrders(req.params.id))));
-  r.post('/brokers/:id/execute', wrap(async (req, res) => res.json(await executeBrokerOrders(req.params.id))));
-  r.post('/brokers/:id/reject', wrap((req, res) => res.json(rejectBrokerOrders(req.params.id))));
-  r.post('/brokers/:id/cancel-order', wrap(async (req, res) => res.json(await cancelBrokerOrder(req.params.id, req.body?.orderId || null))));
-  r.post('/brokers/:id/reset-daily-stop', wrap((req, res) => res.json(resetBrokerDailyStop(req.params.id))));
-  r.get('/brokers/:id/events', wrap((req, res) => res.json({ events: listBrokerEvents(req.params.id, req.query.limit) })));
-  r.get('/brokers/:id/decisions', wrap((req, res) => res.json({ decisions: listTradeDecisions(req.params.id, { fromTs: req.query.from, limit: req.query.limit }) })));
-  r.post('/brokers-stop-all', wrap(async (req, res) => res.json(await stopAllBrokerTrading())));
-
-  // ---------- новости (только для прогноза «сейчас» и живой проверки) ----------
-  r.get('/news', (req, res) => res.json({
-    items: listNews({ symbol: req.query.symbol || undefined, hours: Number(req.query.hours) || 72, limit: Number(req.query.limit) || 30 }),
-  }));
-
-  // ---------- подробное досье акции (котировки, график, прогноз, соседи по карте, дивиденды, бизнес-профиль, сделки пользователя, новости) ----------
-  r.get('/stock/:symbol', wrap(async (req, res) => {
-    const sym = String(req.params.symbol || '').toUpperCase().trim();
-    if (!sym || sym.length > 20) throw new Error('Некорректный тикер');
-
-    const nowTs = Date.now();
-    const [fc, rawSpecs, divs, tbLiveBars, tbMinBars] = await Promise.all([
-      forecastNow(getSettings()).catch(() => null),
-      ensureBoardSpecs().catch(() => ({})),
-      ensureDividends(sym).catch(() => []),
-      fetchTbankCandles(sym, nowTs - 2 * DAY, nowTs, { includeIncomplete: true }).catch(() => null),
-      fetchTbankCandles(sym, nowTs - DAY + 5 * 60000, nowTs, { includeIncomplete: true, intervalMin: 1 }).catch(() => null),
-      ensureCandles(sym, 10, nowTs - 5 * DAY, nowTs, { signal: AbortSignal.timeout(4000) }).catch(() => null),
-    ]);
-    if (tbLiveBars?.length) {
-      const doneBars = tbLiveBars.filter((b) => b.isComplete);
-      if (doneBars.length) saveCandles(sym, 10, doneBars);
-    }
-    const tbMap = kvGet('tbankShortableMap') || {};
-    const tbSpecs = tbMap.specMap || {};
-    const shortableMap = tbMap.map || {};
-    const sp = { ...(rawSpecs[sym] || { lotSize: 1, minStep: 0.01, decimals: 2, issueSize: 0, lastPrice: 0 }), ...(tbSpecs[sym] || {}) };
-    const vocabList = kvGet('vocab')?.list || [];
-    const vocabHit = vocabList.find((v) => v.symbol === sym);
-    const fcRow = fc?.rows?.find((x) => x.symbol === sym) || null;
-    const isTier1 = TIER1_LIQUID_SYMBOLS.has(sym);
-    const tierMult = symbolEdgeMult(sym);
-
-    // 10-минутные свечи за последние 30 дней (для детального просмотра 1Д / 1Н / 1М) + дневной ряд за всё время (1Г / Все)
-    const rawBars30d = loadCandles(sym, 10, nowTs - 35 * DAY, nowTs + DAY);
-    const intraday = rawBars30d.slice(-1500).map((b) => ({
-      ts: b.ts,
-      o: b.open,
-      h: b.high,
-      l: b.low,
-      c: b.close,
-      v: b.value || 0,
-    }));
-
-    const allBars = db.prepare('SELECT ts, open, high, low, close, value FROM candles WHERE symbol = ? AND interval = 10 ORDER BY ts ASC').all(sym);
-    const dailyMap = new Map();
-    for (const b of allBars) {
-      const dayKey = Math.floor((b.ts + MSK) / DAY) * DAY;
-      let d = dailyMap.get(dayKey);
-      if (!d) {
-        d = { ts: dayKey, o: b.open, h: b.high, l: b.low, c: b.close, v: b.value || 0 };
-        dailyMap.set(dayKey, d);
-      } else {
-        if (b.high > d.h) d.h = b.high;
-        if (b.low > 0 && (d.l <= 0 || b.low < d.l)) d.l = b.low;
-        d.c = b.close;
-        d.v += b.value || 0;
-      }
-    }
-    const daily = [...dailyMap.values()];
-
-    const tbFresh1m = tbMinBars?.length ? tbMinBars[tbMinBars.length - 1] : null;
-    const tbFreshBar = tbLiveBars?.length ? tbLiveBars[tbLiveBars.length - 1] : null;
-    const curPrice = (tbFresh1m?.close > 0 ? tbFresh1m.close : 0) || (tbFreshBar?.close > 0 ? tbFreshBar.close : 0) || fcRow?.price || intraday[intraday.length - 1]?.c || daily[daily.length - 1]?.c || sp.lastPrice || 0;
-    const intraday1m = (tbMinBars || []).map((b) => ({
-      ts: b.ts,
-      o: b.open,
-      h: b.high,
-      l: b.low,
-      c: b.close,
-      v: b.value || 0,
-    }));
-    if (curPrice > 0 && intraday1m.length) {
-      const last1m = intraday1m[intraday1m.length - 1];
-      const liveMinSlotTs = Math.floor(nowTs / 60000) * 60000;
-      if (liveMinSlotTs > last1m.ts && liveMinSlotTs - last1m.ts <= 3600000) {
-        intraday1m.push({ ts: liveMinSlotTs, o: last1m.c, h: Math.max(last1m.c, curPrice), l: Math.min(last1m.c, curPrice), c: curPrice, v: 0 });
-      } else if (last1m.c !== curPrice) {
-        last1m.c = curPrice;
-        if (curPrice > last1m.h) last1m.h = curPrice;
-        if (last1m.l <= 0 || curPrice < last1m.l) last1m.l = curPrice;
-      }
-    }
-    if (tbFreshBar && !tbFreshBar.isComplete && intraday.length) {
-      const lastBar = intraday[intraday.length - 1];
-      if (tbFreshBar.ts > lastBar.ts) {
-        intraday.push({ ts: tbFreshBar.ts, o: tbFreshBar.open, h: tbFreshBar.high, l: tbFreshBar.low, c: curPrice, v: tbFreshBar.value || 0 });
-      } else if (tbFreshBar.ts === lastBar.ts) {
-        lastBar.c = curPrice;
-        if (tbFreshBar.high > lastBar.h) lastBar.h = tbFreshBar.high;
-        if (tbFreshBar.low > 0 && (lastBar.l <= 0 || tbFreshBar.low < lastBar.l)) lastBar.l = tbFreshBar.low;
-      }
-    }
-    if (curPrice > 0 && intraday.length) {
-      const lastBar = intraday[intraday.length - 1];
-      const liveSlotTs = Math.floor((fc?.liveTs || nowTs) / 600000) * 600000;
-      if (liveSlotTs > lastBar.ts && liveSlotTs - lastBar.ts <= 6 * 3600000) {
-        intraday.push({ ts: liveSlotTs, o: lastBar.c, h: Math.max(lastBar.c, curPrice), l: Math.min(lastBar.c, curPrice), c: curPrice, v: 0 });
-      } else if (lastBar.c !== curPrice) {
-        lastBar.c = curPrice;
-        if (curPrice > lastBar.h) lastBar.h = curPrice;
-        if (lastBar.l <= 0 || curPrice < lastBar.l) lastBar.l = curPrice;
-      }
-      if (daily.length) {
-        const lastDay = daily[daily.length - 1];
-        lastDay.c = curPrice;
-        if (curPrice > lastDay.h) lastDay.h = curPrice;
-        if (lastDay.l <= 0 || curPrice < lastDay.l) lastDay.l = curPrice;
-      }
-    }
-    const prevDayClose = daily.length >= 2 ? daily[daily.length - 2].c : (daily[0]?.o || curPrice);
-    const dayChangePct = prevDayClose > 0 && curPrice > 0 ? round(((curPrice - prevDayClose) / prevDayClose) * 100, 2) : 0;
-    const monthAgoClose = daily.length >= 22 ? daily[daily.length - 22].c : (daily[0]?.o || curPrice);
-    const monthChangePct = monthAgoClose > 0 && curPrice > 0 ? round(((curPrice - monthAgoClose) / monthAgoClose) * 100, 2) : 0;
-    const yearAgoClose = daily.length >= 250 ? daily[daily.length - 250].c : (daily[0]?.o || curPrice);
-    const yearChangePct = yearAgoClose > 0 && curPrice > 0 ? round(((curPrice - yearAgoClose) / yearAgoClose) * 100, 2) : 0;
-    const marketCapRub = sp.issueSize > 0 && curPrice > 0 ? Math.round(sp.issueSize * curPrice) : null;
-
-    // 20 факторов бизнес-профиля
-    const profMap = loadProfiles();
-    const profVec = profMap.get(sym) || null;
-    const traits = profVec ? TRAITS.map((t, idx) => ({ id: t.id, label: t.label, ask: t.ask, value: round(profVec[idx] ?? 0, 2) })) : [];
-
-    // Позиции и сделки пользователя по этой акции на подключённых брокерских счетах
-    const bState = brokersState();
-    const userPositions = [];
-    const userOperations = [];
-    for (const acc of bState.accounts || []) {
-      const pos = (acc.lastSync?.positions || []).find((p) => p.symbol === sym && p.qty !== 0);
-      if (pos) {
-        const livePx = curPrice > 0 ? curPrice : pos.price;
-        const avgPx = Number(pos.avgPrice) || 0;
-        const valRub = round(pos.qty * livePx, 2);
-        const pnlRub = avgPx > 0 ? round(pos.qty * (livePx - avgPx), 2) : pos.pnlRub;
-        const costBasis = avgPx > 0 ? Math.abs(pos.qty) * avgPx : 0;
-        const pnlPct = costBasis > 0 ? round((pnlRub / costBasis) * 100, 2) : pos.pnlPct;
-        userPositions.push({ accountName: acc.name, broker: acc.broker, ...pos, price: livePx, valueRub: valRub, pnlRub, pnlPct });
-      }
-      for (const op of acc.lastHistory?.operations || []) {
-        if (op.symbol === sym && (op.kind === 'buy' || op.kind === 'sell' || op.kind === 'div' || op.kind === 'fee')) {
-          userOperations.push({ accountName: acc.name, ...op });
-        }
-      }
-    }
-    userOperations.sort((a, b) => (b.date || 0) - (a.date || 0));
-
-    // Считаем историческую результативность по бумаге в последнем эталонном эксперименте
-    let backtestStat = null;
-    const lastModelRun = listRuns().find((run) => run.mode === 'model' && run.status === 'done');
-    if (lastModelRun) {
-      const simTrades = db.prepare('SELECT side, entry_ts, exit_ts, entry_price, exit_price, pnl, pnl_pct FROM trades WHERE run_id = ? AND symbol = ? ORDER BY entry_ts DESC').all(lastModelRun.id, sym);
-      if (simTrades.length) {
-        const wins = simTrades.filter((t) => t.pnl > 0).length;
-        const avgPct = simTrades.reduce((s, t) => s + (t.pnl_pct || 0), 0) / simTrades.length;
-        backtestStat = {
-          runId: lastModelRun.id,
-          tradesCount: simTrades.length,
-          winRate: round((wins / simTrades.length) * 100, 1),
-          avgPnlPct: round(avgPct, 2),
-          recentTrades: simTrades.slice(0, 10),
-        };
-      }
-    }
-
-    const news = listNews({ symbol: sym, hours: 24 * 30, limit: 20 });
-    const sortedDivs = [...(divs || [])].sort((a, b) => String(b.registry).localeCompare(String(a.registry)));
-
-    res.json({
-      symbol: sym,
-      name: fcRow?.name || vocabHit?.name || sym,
-      price: round(curPrice, curPrice < 1 ? 5 : curPrice < 10 ? 3 : 2),
-      dayChangePct,
-      monthChangePct,
-      yearChangePct,
-      tier: isTier1 ? 1 : 2,
-      tierLabel: isTier1 ? '1-й эшелон (высокая ликвидность)' : '2-й эшелон',
-      edgeMult: fcRow?.edgeMult ?? round(tierMult, 3),
-      sigmaPct: fcRow?.sigmaPct ?? null,
-      buyThresholdPct: fcRow?.buyThresholdPct ?? round(Math.max((fc?.buyThresholdPct || 0.40) * tierMult, 0.30), 3),
-      shortThresholdPct: fcRow?.shortThresholdPct ?? round(Math.max((fc?.shortThresholdPct || 0.50) * tierMult, 0.31), 3),
-      shortAllowedByBroker: shortableMap[sym] !== undefined ? Boolean(shortableMap[sym]) : null,
-      specs: {
-        lotSize: sp.lotSize,
-        lotCostRub: round((sp.lotSize || 1) * curPrice, 2),
-        minStep: sp.minStep,
-        decimals: sp.decimals,
-        issueSize: sp.issueSize || null,
-        marketCapRub,
-        indexWeightPct: vocabHit?.weight ? round(vocabHit.weight, 2) : null,
-      },
-      forecast: fcRow ? {
-        bar: fc?.bar,
-        horizonHours: fc?.horizon || 2.5,
-        expectedPct: fcRow.expectedPct,
-        lastMovePct: fcRow.lastMovePct ?? 0,
-        deltaPct: fcRow.deltaPct || 0,
-        signal: Boolean(fcRow.signal),
-        shortSignal: Boolean(fcRow.shortSignal),
-        shortBlockedByBroker: Boolean(fcRow.shortBlockedByBroker),
-        shortBlockedBySqueeze: Boolean(fcRow.shortBlockedBySqueeze),
-        buyBlockedByDip: Boolean(fcRow.buyBlockedByDip),
-        buyBlockedByDiv: fcRow.buyBlockedByDiv || null,
-        shortBlockedByDiv: fcRow.shortBlockedByDiv || null,
-        buyBlockedByNews: fcRow.buyBlockedByNews || null,
-        shortBlockedByNews: fcRow.shortBlockedByNews || null,
-        selfPct: fcRow.selfPct ?? 0,
-        influences: (fcRow.influences || []).map((inf) => {
-          const infRow = fc?.rows?.find((x) => x.symbol === inf.symbol);
-          return { ...inf, name: infRow?.name || inf.symbol, price: infRow?.price || null, expectedPct: infRow?.expectedPct ?? null };
-        }),
-      } : null,
-      traits,
-      dividends: sortedDivs,
-      news,
-      userPositions,
-      userOperations: userOperations.slice(0, 60),
-      backtestStat,
-      intraday1m,
-      intraday,
-      daily,
-    });
-  }));
-
-  // ---------- журнал гипотез ----------
-  r.get('/journal', (req, res) => res.json(listJournal(500)));
-  r.post('/journal', wrap((req, res) => {
-    const id = addJournal({ ...req.body, source: 'user' });
-    hub.emit({ type: 'journal:update' });
-    res.json({ id });
-  }));
-  r.delete('/journal/:id', (req, res) => { deleteJournal(Number(req.params.id)); hub.emit({ type: 'journal:update' }); res.json({ ok: true }); });
-
-  // ---------- чат со Стратегом ----------
-  r.get('/chat', (req, res) => res.json(strategist.history()));
-  r.post('/chat/send', wrap((req, res) => {
-    const plan = effectivePlan(req.user);
-    if (countUserChatToday() >= plan.maxChatPerDay) {
-      throw new Error(`Достигнут дневной лимит сообщений ИИ-Стратегу по тарифу «${plan.name}» (${plan.maxChatPerDay} в сутки).`);
-    }
-    const { text, mode, newSession, title } = req.body || {};
-    res.json({ message: strategist.sendUserMessage(text, mode, { newSession: Boolean(newSession), title: title || null }) });
-  }));
-  r.post('/chat/action', wrap((req, res) => {
-    const { msgId, callId, decision, comment } = req.body || {};
-    strategist.resolveAction(Number(msgId), String(callId), decision, comment);
-    res.json({ ok: true });
-  }));
-  r.post('/chat/stop', (req, res) => { strategist.stopAgent(); res.json({ ok: true }); });
-  r.post('/chat/mode', wrap((req, res) => { strategist.setMode(req.body?.mode, req.body?.budget); res.json(strategist.chatState()); }));
-  r.post('/chat/new', (req, res) => { strategist.resetConversation(); res.json(strategist.history()); });
-  r.get('/chat/archive', (req, res) => res.json({ sessions: strategist.listArchivedSessions(120) }));
-  r.post('/chat/archive/:id/open', wrap((req, res) => res.json(strategist.openArchivedSession(Number(req.params.id)))));
-  r.get('/chat/archive/:id/md', wrap((req, res) => {
-    const info = strategist.exportConversationMarkdown(Number(req.params.id));
-    if (!info) throw Object.assign(new Error('Сессия не найдена или пуста'), { status: 404 });
-    res.json(info);
-  }));
-
-  return r;
-}
+// Copyright (c) 2026 Roman A. Perepelkin. All rights reserved. Proprietary software.
+import express from 'express';
+import { strategyDefaults } from '../config.js';
+import { activeModelInfo } from '../llm/client.js';
+import {
+  listProviders, getSelected, addProvider, updateProvider, deleteProvider,
+  fetchRemoteModels, testProvider, selectModel,
+} from '../llm/providers.js';
+import {
+  getLocalEngineFullState, startLocalModelInstall, cancelLocalModelInstall,
+  startLocalEngine, stopLocalEngine, deleteLocalModel,
+} from '../llm/local-engine.js';
+import {
+  listRuns, allRuns, getRun, getTrades, deleteRun, updateRunTitle,
+  countUserRunsToday, countUserChatToday, listJournal, deleteJournal, addJournal,
+  listSettingsHistory, kvGet, db, loadCandles, saveCandles,
+} from '../db.js';
+import {
+  PLANS, effectivePlan, publicUser, createSession, deleteSession, parseAllCookieValues,
+  isLoopbackRequest, getTerminalLicenseState, activateTerminalByToken,
+  loginRemoteTerminal, setTerminalLocalPassword,
+} from '../auth/index.js';
+import { publicNotifyConfig, saveNotifyConfig, notifyUser } from '../notify/index.js';
+import { PARAMS } from '../params-meta.js';
+import { getSettings, updateSettings, resetSettings, revertSettingsChange } from '../settings.js';
+import { startModelResearch, cancelModelResearch, startStabilityCheck, cancelStabilityCheck } from '../model/research.js';
+import { forecastNow, TIER1_LIQUID_SYMBOLS, symbolEdgeMult } from '../model/forecast.js';
+import { profilesInfo, startProfilesRefresh, TRAITS, loadProfiles } from '../model/profiles.js';
+import { ensureDividends, ensureCandles } from '../data/moex.js';
+import { live } from '../model/live.js';
+import {
+  brokersState, saveBrokerAccount, deleteBrokerAccount, syncBrokerAccount, discoverBrokerAccounts,
+  freezeBrokerBaseline, fetchBrokerHistory, prepareBrokerOrders, executeBrokerOrders,
+  rejectBrokerOrders, cancelBrokerOrder, triggerBrokerFastEntryCheck, ensureBoardSpecs,
+  resetBrokerDailyStop, listBrokerEvents, listTradeDecisions, stopAllBrokerTrading, fetchTbankCandles,
+} from '../brokers/index.js';
+import { listNews } from '../news/index.js';
+import * as strategist from '../strategist/index.js';
+import { round, MSK, DAY } from '../util.js';
+import { hub } from '../hub.js';
+import { isCrossOrigin } from '../security.js';
+
+function clientIp(req) {
+  const xff = String(req?.headers?.['x-forwarded-for'] || '').split(',').map((s) => s.trim()).filter(Boolean);
+  if (process.env.TRUST_PROXY === '1' && xff.length) return xff[xff.length - 1];
+  return String(req?.socket?.remoteAddress || '');
+}
+
+function isHttpsRequest(req) {
+  return Boolean(req?.secure || String(req?.headers?.['x-forwarded-proto'] || '').split(',')[0].trim() === 'https');
+}
+
+export function createRouter() {
+  const r = express.Router();
+  const wrap = (fn) => (req, res) => Promise.resolve()
+    .then(() => fn(req, res))
+    .catch((e) => res.status(e.status || 400).json({ error: e.message }));
+
+  const PUBLIC_API = [/^\/local\/(status|activate|login)$/];
+
+  r.use((req, res, next) => {
+    const isRead = req.method === 'GET' || req.method === 'HEAD' || req.method === 'OPTIONS';
+    if (!isRead && isCrossOrigin(req)) {
+      return res.status(403).json({ error: 'Запрос с чужого сайта отклонён' });
+    }
+    if (req.user || PUBLIC_API.some((rx) => rx.test(req.path))) return next();
+    return res.status(401).json({ error: 'Требуется активация или вход в терминал' });
+  });
+
+  const setCookie = (res, sid, maxAgeSec = 30 * 86400) => {
+    const secure = isHttpsRequest(res.req) ? '; Secure' : '';
+    res.setHeader('Set-Cookie', `sid=${encodeURIComponent(sid)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${maxAgeSec}${secure}`);
+  };
+
+  // ---------- Состояние лицензии, активация по токену ЛК и вход на удалённый VPS ----------
+  r.get('/local/status', (req, res) => {
+    const st = getTerminalLicenseState();
+    res.json({
+      ...st,
+      loggedIn: Boolean(req.user),
+      isLoopback: isLoopbackRequest(req),
+    });
+  });
+
+  r.post('/local/activate', wrap(async (req, res) => {
+    const st = getTerminalLicenseState();
+    // Повторная привязка из неавторизованной внешней сети блокируется, если терминал уже активирован (кроме режима разработчика)
+    if (st.activated && !st.devBypass && !req.user && !isLoopbackRequest(req)) {
+      throw Object.assign(new Error('Терминал уже активирован. Войдите по своему токену личного кабинета или локальному паролю.'), { status: 409 });
+    }
+    const out = await activateTerminalByToken({
+      token: req.body?.token,
+      portalUrl: req.body?.portalUrl,
+      slotId: req.body?.slotId,
+    });
+    if (!out.chooseSlot) {
+      const sid = createSession(1, 30);
+      setCookie(res, sid);
+      llmChanged();
+    }
+    res.json(out);
+  }));
+
+  r.post('/local/login', wrap(async (req, res) => {
+    const sid = await loginRemoteTerminal(req.body?.secret, { ip: clientIp(req) });
+    setCookie(res, sid);
+    res.json({ ok: true });
+  }));
+
+  r.post('/local/refresh-license', wrap(async (req, res) => {
+    const cur = getTerminalLicenseState();
+    const out = await activateTerminalByToken({
+      token: req.body?.token || '',
+      portalUrl: req.body?.portalUrl || cur.portalUrl,
+      slotId: req.body?.slotId || cur.licId || '',
+    });
+    llmChanged();
+    res.json(out);
+  }));
+
+  r.post('/local/password', wrap((req, res) => {
+    res.json(setTerminalLocalPassword(req.body?.password || ''));
+  }));
+
+  // ---------- Конфигурация терминала и профиль лицензии ----------
+  r.get('/config', (req, res) => res.json({
+    defaults: strategyDefaults,
+    params: PARAMS,
+    llm: activeModelInfo(),
+    user: publicUser(req.user),
+    plans: PLANS,
+    notify: publicNotifyConfig(),
+  }));
+
+  r.get('/auth/me', (req, res) => res.json({
+    user: publicUser(req.user),
+    license: getTerminalLicenseState(),
+    plans: PLANS,
+    notify: publicNotifyConfig(),
+    isLoopback: isLoopbackRequest(req),
+  }));
+
+  r.post('/auth/logout', (req, res) => {
+    for (const tok of parseAllCookieValues(req.headers?.cookie, 'sid')) {
+      if (tok && tok !== 'logged_out') deleteSession(tok);
+    }
+    setCookie(res, 'logged_out', 365 * 86400);
+    res.json({ ok: true });
+  });
+
+  // ---------- Уведомления (шлюз портала + опционально прямой личный бот) ----------
+  r.post('/notify/config', wrap((req, res) => {
+    res.json({ ok: true, notify: saveNotifyConfig(req.body || {}) });
+  }));
+
+  r.post('/notify/test', wrap(async (req, res) => {
+    const sent = await notifyUser(1, '◈ НейроАльфа Терминал: тестовое уведомление успешно доставлено.');
+    if (!sent.tg && !sent.max) {
+      throw new Error('Уведомление не доставлено: привяжите Telegram/MAX по коду в личном кабинете на портале либо укажите токен личного бота ниже.');
+    }
+    res.json({ ok: true, ...sent });
+  }));
+
+  // ---------- Модели ИИ для Стратега (облачный прокси, внешние API и локальный движок llama.cpp) ----------
+  const llmState = () => ({ providers: listProviders(), selected: getSelected(), active: activeModelInfo() });
+  const llmChanged = () => {
+    hub.emit({ type: 'llm:changed', llm: activeModelInfo() });
+    hub.emit({ type: 'chat:state', state: strategist.chatState() });
+  };
+
+  r.get('/llm/providers', wrap((req, res) => res.json(llmState())));
+  r.post('/llm/providers', wrap((req, res) => { const p = addProvider(req.body); llmChanged(); res.json({ provider: p, ...llmState() }); }));
+  r.put('/llm/providers/:id', wrap((req, res) => { const p = updateProvider(req.params.id, req.body); llmChanged(); res.json({ provider: p, ...llmState() }); }));
+  r.delete('/llm/providers/:id', wrap((req, res) => { deleteProvider(req.params.id); llmChanged(); res.json(llmState()); }));
+  r.get('/llm/providers/:id/remote-models', wrap(async (req, res) => res.json({ models: await fetchRemoteModels(req.params.id) })));
+  r.post('/llm/test', wrap(async (req, res) => res.json(await testProvider(req.body?.providerId, req.body?.model))));
+  r.post('/llm/select', wrap((req, res) => { selectModel(req.body?.providerId, req.body?.model); llmChanged(); res.json(llmState()); }));
+
+  // Локальная модель ИИ (диагностика железа, скачивание и запуск llama-server + Qwen3 GGUF)
+  r.get('/llm/local/state', wrap(async (req, res) => {
+    res.json(await getLocalEngineFullState({ refresh: req.query.refresh === '1' }));
+  }));
+  r.post('/llm/local/install', wrap((req, res) => {
+    res.json(startLocalModelInstall(req.body || {}));
+  }));
+  r.post('/llm/local/cancel', wrap((req, res) => {
+    res.json(cancelLocalModelInstall());
+  }));
+  r.post('/llm/local/start', wrap(async (req, res) => {
+    const st = await startLocalEngine(req.body || {});
+    llmChanged();
+    res.json(st);
+  }));
+  r.post('/llm/local/stop', wrap((req, res) => {
+    stopLocalEngine();
+    llmChanged();
+    res.json({ ok: true });
+  }));
+  r.delete('/llm/local/model/:id', wrap((req, res) => {
+    res.json(deleteLocalModel(req.params.id));
+  }));
+
+  // ---------- Настройки стратегии ----------
+  r.get('/settings', (req, res) => res.json(getSettings()));
+  r.put('/settings', wrap((req, res) => res.json(updateSettings(req.body || {}, { source: 'user' }))));
+  r.post('/settings/reset', (req, res) => res.json(resetSettings('user')));
+  r.get('/settings/history', (req, res) => res.json(listSettingsHistory(Math.min(200, Number(req.query.limit) || 50))));
+  r.post('/settings/history/:id/revert', wrap((req, res) => res.json(revertSettingsChange(req.params.id))));
+
+  // ---------- Исследования и история прогонов ----------
+  const ownRunOr404 = (req) => {
+    const run = getRun(Number(req.params.id));
+    if (!run) throw Object.assign(new Error('Не найдено'), { status: 404 });
+    return run;
+  };
+  r.get('/runs', (req, res) => res.json(listRuns()));
+  r.get('/runs/:id', (req, res) => {
+    const run = getRun(Number(req.params.id));
+    if (!run) return res.status(404).json({ error: 'Не найдено' });
+    res.json({ ...run, trades: getTrades(run.id) });
+  });
+  r.put('/runs/:id/title', wrap((req, res) => {
+    ownRunOr404(req);
+    const updated = updateRunTitle(Number(req.params.id), req.body?.title || '');
+    if (!updated) return res.status(404).json({ error: 'Не найдено' });
+    res.json(updated);
+  }));
+  r.post('/runs/:id/stability', wrap((req, res) => { ownRunOr404(req); res.json(startStabilityCheck(Number(req.params.id))); }));
+  r.post('/runs/:id/stability/cancel', wrap((req, res) => { ownRunOr404(req); res.json({ ok: cancelStabilityCheck(Number(req.params.id)) }); }));
+  r.delete('/runs/:id', wrap((req, res) => {
+    const run = ownRunOr404(req);
+    if (run?.status === 'running') throw new Error('Эксперимент ещё идёт — сначала отмените его');
+    deleteRun(Number(req.params.id));
+    res.json({ ok: true });
+  }));
+  r.post('/runs/cleanup', wrap((req, res) => {
+    const raw = Number(req.body?.keep);
+    const keep = Number.isFinite(raw) ? Math.max(0, Math.min(50, Math.floor(raw))) : 0;
+    const all = allRuns();
+    const done = all.filter((x) => x.mode === 'model' && x.status === 'done');
+    const ranked = [...done].sort((a, b) => (b.metrics?.full?.returnPct ?? -1e9) - (a.metrics?.full?.returnPct ?? -1e9));
+    const keepSet = new Set(ranked.slice(0, keep).map((x) => x.id));
+    let deleted = 0;
+    for (const item of all) {
+      if (item.mode !== 'model' || item.status === 'running' || keepSet.has(item.id)) continue;
+      deleteRun(item.id);
+      deleted++;
+    }
+    res.json({ deleted, kept: [...keepSet] });
+  }));
+
+  r.post('/model/research', wrap((req, res) => {
+    const plan = effectivePlan();
+    if (!plan.allowResearch) {
+      throw new Error('Раздел исследований доступен только по лицензии «Хозяин».');
+    }
+    if (countUserRunsToday() >= plan.maxRunsPerDay) {
+      throw new Error(`Достигнут дневной лимит исследований (${plan.maxRunsPerDay} в сутки).`);
+    }
+    const body = req.body || {};
+    const merged = { ...getSettings(), ...body };
+    const { runId, reused } = startModelResearch(merged, { source: 'user', force: !!body.force });
+    res.json({ runId, reused: !!reused });
+  }));
+  r.post('/model/:id/cancel', wrap((req, res) => { ownRunOr404(req); res.json({ ok: cancelModelResearch(Number(req.params.id)) }); }));
+  r.get('/model/forecast', wrap(async (req, res) => {
+    const fc = await forecastNow(getSettings(), { force: req.query.force === '1' });
+    if (fc?.rows?.some((x) => x.signal || x.shortSignal)) {
+      triggerBrokerFastEntryCheck();
+    }
+    res.json(fc);
+  }));
+
+  // ---------- Описания компаний ----------
+  r.get('/profiles', wrap(async (req, res) => res.json(await profilesInfo())));
+  r.post('/profiles/refresh', wrap((req, res) => res.json(startProfilesRefresh())));
+
+  // ---------- Виртуальные счета (песочница живой проверки) ----------
+  r.get('/live/status', (req, res) => res.json(live.status()));
+  r.post('/live/start', wrap(async (req, res) => {
+    const plan = effectivePlan();
+    const b = req.body || {};
+    const runId = await live.start(getSettings(), {
+      source: 'user',
+      baseRunId: b.baseRunId || null,
+      name: b.name || '',
+      capital: b.capital || null,
+      maxAccounts: plan.maxVirtualAccounts,
+    });
+    res.json({ runId, status: live.status() });
+  }));
+  r.post('/live/stop', (req, res) => res.json({ ok: live.stop(req.body?.runId || null), status: live.status() }));
+  r.delete('/live/:id', (req, res) => res.json({ ok: live.remove(Number(req.params.id)), status: live.status() }));
+
+  // ---------- Брокерские счета (Т-Банк, Финам, Алор, БКС) ----------
+  r.get('/brokers', (req, res) => res.json(brokersState()));
+  r.post('/brokers/discover', wrap(async (req, res) => res.json(await discoverBrokerAccounts(req.body || {}))));
+  r.post('/brokers', wrap((req, res) => {
+    const plan = effectivePlan();
+    const cur = brokersState().accounts.length;
+    if (!req.body?.id && cur >= plan.maxBrokerAccounts) {
+      if ((plan.maxBrokerAccounts ?? 0) < 1) {
+        throw new Error('Для подключения брокерского счёта активируйте оплаченную лицензию из личного кабинета.');
+      }
+      throw new Error(`По вашей лицензии «${plan.name}» доступно подключение до ${plan.maxBrokerAccounts} брокерских счетов.`);
+    }
+    res.json(saveBrokerAccount(req.body || {}));
+  }));
+  r.put('/brokers/:id', wrap((req, res) => res.json(saveBrokerAccount({ ...(req.body || {}), id: req.params.id }))));
+  r.delete('/brokers/:id', wrap((req, res) => res.json(deleteBrokerAccount(req.params.id))));
+  r.post('/brokers/:id/sync', wrap(async (req, res) => res.json(await syncBrokerAccount(req.params.id))));
+  r.post('/brokers/:id/history', wrap(async (req, res) => res.json(await fetchBrokerHistory(req.params.id, req.body || {}))));
+  r.post('/brokers/:id/freeze-baseline', wrap(async (req, res) => res.json(await freezeBrokerBaseline(req.params.id))));
+  r.post('/brokers/:id/prepare', wrap(async (req, res) => res.json(await prepareBrokerOrders(req.params.id))));
+  r.post('/brokers/:id/execute', wrap(async (req, res) => res.json(await executeBrokerOrders(req.params.id))));
+  r.post('/brokers/:id/reject', wrap((req, res) => res.json(rejectBrokerOrders(req.params.id))));
+  r.post('/brokers/:id/cancel-order', wrap(async (req, res) => res.json(await cancelBrokerOrder(req.params.id, req.body?.orderId || null))));
+  r.post('/brokers/:id/reset-daily-stop', wrap((req, res) => res.json(resetBrokerDailyStop(req.params.id))));
+  r.get('/brokers/:id/events', wrap((req, res) => res.json({ events: listBrokerEvents(req.params.id, req.query.limit) })));
+  r.get('/brokers/:id/decisions', wrap((req, res) => res.json({ decisions: listTradeDecisions(req.params.id, { fromTs: req.query.from, limit: req.query.limit }) })));
+  r.post('/brokers-stop-all', wrap(async (req, res) => res.json(await stopAllBrokerTrading())));
+
+  // ---------- Новости ----------
+  r.get('/news', (req, res) => res.json({
+    items: listNews({ symbol: req.query.symbol || undefined, hours: Number(req.query.hours) || 72, limit: Number(req.query.limit) || 30 }),
+  }));
+
+  // ---------- Досье акции ----------
+  r.get('/stock/:symbol', wrap(async (req, res) => {
+    const sym = String(req.params.symbol || '').toUpperCase().trim();
+    if (!sym || sym.length > 20) throw new Error('Некорректный тикер');
+
+    const nowTs = Date.now();
+    const [fc, rawSpecs, divs, tbLiveBars, tbMinBars] = await Promise.all([
+      forecastNow(getSettings()).catch(() => null),
+      ensureBoardSpecs().catch(() => ({})),
+      ensureDividends(sym).catch(() => []),
+      fetchTbankCandles(sym, nowTs - 2 * DAY, nowTs, { includeIncomplete: true }).catch(() => null),
+      fetchTbankCandles(sym, nowTs - DAY + 5 * 60000, nowTs, { includeIncomplete: true, intervalMin: 1 }).catch(() => null),
+      ensureCandles(sym, 10, nowTs - 5 * DAY, nowTs, { signal: AbortSignal.timeout(4000) }).catch(() => null),
+    ]);
+    if (tbLiveBars?.length) {
+      const doneBars = tbLiveBars.filter((b) => b.isComplete);
+      if (doneBars.length) saveCandles(sym, 10, doneBars);
+    }
+    const tbMap = kvGet('tbankShortableMap') || {};
+    const tbSpecs = tbMap.specMap || {};
+    const shortableMap = tbMap.map || {};
+    const sp = { ...(rawSpecs[sym] || { lotSize: 1, minStep: 0.01, decimals: 2, issueSize: 0, lastPrice: 0 }), ...(tbSpecs[sym] || {}) };
+    const vocabList = kvGet('vocab')?.list || [];
+    const vocabHit = vocabList.find((v) => v.symbol === sym);
+    const fcRow = fc?.rows?.find((x) => x.symbol === sym) || null;
+    const isTier1 = TIER1_LIQUID_SYMBOLS.has(sym);
+    const tierMult = symbolEdgeMult(sym);
+
+    const rawBars30d = loadCandles(sym, 10, nowTs - 35 * DAY, nowTs + DAY);
+    const intraday = rawBars30d.slice(-1500).map((b) => ({
+      ts: b.ts, o: b.open, h: b.high, l: b.low, c: b.close, v: b.value || 0,
+    }));
+
+    const allBars = db.prepare('SELECT ts, open, high, low, close, value FROM candles WHERE symbol = ? AND interval = 10 ORDER BY ts ASC').all(sym);
+    const dailyMap = new Map();
+    for (const b of allBars) {
+      const dayKey = Math.floor((b.ts + MSK) / DAY) * DAY;
+      let d = dailyMap.get(dayKey);
+      if (!d) {
+        d = { ts: dayKey, o: b.open, h: b.high, l: b.low, c: b.close, v: b.value || 0 };
+        dailyMap.set(dayKey, d);
+      } else {
+        if (b.high > d.h) d.h = b.high;
+        if (b.low > 0 && (d.l <= 0 || b.low < d.l)) d.l = b.low;
+        d.c = b.close;
+        d.v += b.value || 0;
+      }
+    }
+    const daily = [...dailyMap.values()];
+
+    const tbFresh1m = tbMinBars?.length ? tbMinBars[tbMinBars.length - 1] : null;
+    const tbFreshBar = tbLiveBars?.length ? tbLiveBars[tbLiveBars.length - 1] : null;
+    const curPrice = (tbFresh1m?.close > 0 ? tbFresh1m.close : 0)
+      || (tbFreshBar?.close > 0 ? tbFreshBar.close : 0)
+      || fcRow?.price || intraday[intraday.length - 1]?.c || daily[daily.length - 1]?.c || sp.lastPrice || 0;
+    const intraday1m = (tbMinBars || []).map((b) => ({
+      ts: b.ts, o: b.open, h: b.high, l: b.low, c: b.close, v: b.value || 0,
+    }));
+    if (curPrice > 0 && intraday1m.length) {
+      const last1m = intraday1m[intraday1m.length - 1];
+      const liveMinSlotTs = Math.floor(nowTs / 60000) * 60000;
+      if (liveMinSlotTs > last1m.ts && liveMinSlotTs - last1m.ts <= 3600000) {
+        intraday1m.push({ ts: liveMinSlotTs, o: last1m.c, h: Math.max(last1m.c, curPrice), l: Math.min(last1m.c, curPrice), c: curPrice, v: 0 });
+      } else if (last1m.c !== curPrice) {
+        last1m.c = curPrice;
+        if (curPrice > last1m.h) last1m.h = curPrice;
+        if (last1m.l <= 0 || curPrice < last1m.l) last1m.l = curPrice;
+      }
+    }
+    if (tbFreshBar && !tbFreshBar.isComplete && intraday.length) {
+      const lastBar = intraday[intraday.length - 1];
+      if (tbFreshBar.ts > lastBar.ts) {
+        intraday.push({ ts: tbFreshBar.ts, o: tbFreshBar.open, h: tbFreshBar.high, l: tbFreshBar.low, c: curPrice, v: tbFreshBar.value || 0 });
+      } else if (tbFreshBar.ts === lastBar.ts) {
+        lastBar.c = curPrice;
+        if (tbFreshBar.high > lastBar.h) lastBar.h = tbFreshBar.high;
+        if (tbFreshBar.low > 0 && (lastBar.l <= 0 || tbFreshBar.low < lastBar.l)) lastBar.l = tbFreshBar.low;
+      }
+    }
+    if (curPrice > 0 && intraday.length) {
+      const lastBar = intraday[intraday.length - 1];
+      const liveSlotTs = Math.floor((fc?.liveTs || nowTs) / 600000) * 600000;
+      if (liveSlotTs > lastBar.ts && liveSlotTs - lastBar.ts <= 6 * 3600000) {
+        intraday.push({ ts: liveSlotTs, o: lastBar.c, h: Math.max(lastBar.c, curPrice), l: Math.min(lastBar.c, curPrice), c: curPrice, v: 0 });
+      } else if (lastBar.c !== curPrice) {
+        lastBar.c = curPrice;
+        if (curPrice > lastBar.h) lastBar.h = curPrice;
+        if (lastBar.l <= 0 || curPrice < lastBar.l) lastBar.l = curPrice;
+      }
+      if (daily.length) {
+        const lastDay = daily[daily.length - 1];
+        lastDay.c = curPrice;
+        if (curPrice > lastDay.h) lastDay.h = curPrice;
+        if (lastDay.l <= 0 || curPrice < lastDay.l) lastDay.l = curPrice;
+      }
+    }
+    const prevDayClose = daily.length >= 2 ? daily[daily.length - 2].c : (daily[0]?.o || curPrice);
+    const dayChangePct = prevDayClose > 0 && curPrice > 0 ? round(((curPrice - prevDayClose) / prevDayClose) * 100, 2) : 0;
+    const monthAgoClose = daily.length >= 22 ? daily[daily.length - 22].c : (daily[0]?.o || curPrice);
+    const monthChangePct = monthAgoClose > 0 && curPrice > 0 ? round(((curPrice - monthAgoClose) / monthAgoClose) * 100, 2) : 0;
+    const yearAgoClose = daily.length >= 250 ? daily[daily.length - 250].c : (daily[0]?.o || curPrice);
+    const yearChangePct = yearAgoClose > 0 && curPrice > 0 ? round(((curPrice - yearAgoClose) / yearAgoClose) * 100, 2) : 0;
+    const marketCapRub = sp.issueSize > 0 && curPrice > 0 ? Math.round(sp.issueSize * curPrice) : null;
+
+    const profMap = loadProfiles();
+    const profVec = profMap.get(sym) || null;
+    const traits = profVec ? TRAITS.map((t, idx) => ({ id: t.id, label: t.label, ask: t.ask, value: round(profVec[idx] ?? 0, 2) })) : [];
+
+    const bState = brokersState();
+    const userPositions = [];
+    const userOperations = [];
+    for (const acc of bState.accounts || []) {
+      const pos = (acc.lastSync?.positions || []).find((p) => p.symbol === sym && p.qty !== 0);
+      if (pos) {
+        const livePx = curPrice > 0 ? curPrice : pos.price;
+        const avgPx = Number(pos.avgPrice) || 0;
+        const valRub = round(pos.qty * livePx, 2);
+        const pnlRub = avgPx > 0 ? round(pos.qty * (livePx - avgPx), 2) : pos.pnlRub;
+        const costBasis = avgPx > 0 ? Math.abs(pos.qty) * avgPx : 0;
+        const pnlPct = costBasis > 0 ? round((pnlRub / costBasis) * 100, 2) : pos.pnlPct;
+        userPositions.push({ accountName: acc.name, broker: acc.broker, ...pos, price: livePx, valueRub: valRub, pnlRub, pnlPct });
+      }
+      for (const op of acc.lastHistory?.operations || []) {
+        if (op.symbol === sym && (op.kind === 'buy' || op.kind === 'sell' || op.kind === 'div' || op.kind === 'fee')) {
+          userOperations.push({ accountName: acc.name, ...op });
+        }
+      }
+    }
+    userOperations.sort((a, b) => (b.date || 0) - (a.date || 0));
+
+    let backtestStat = null;
+    const lastModelRun = listRuns().find((run) => run.mode === 'model' && run.status === 'done');
+    if (lastModelRun) {
+      const simTrades = db.prepare('SELECT side, entry_ts, exit_ts, entry_price, exit_price, pnl, pnl_pct FROM trades WHERE run_id = ? AND symbol = ? ORDER BY entry_ts DESC').all(lastModelRun.id, sym);
+      if (simTrades.length) {
+        const wins = simTrades.filter((t) => t.pnl > 0).length;
+        const avgPct = simTrades.reduce((s, t) => s + (t.pnl_pct || 0), 0) / simTrades.length;
+        backtestStat = {
+          runId: lastModelRun.id,
+          tradesCount: simTrades.length,
+          winRate: round((wins / simTrades.length) * 100, 1),
+          avgPnlPct: round(avgPct, 2),
+          recentTrades: simTrades.slice(0, 10),
+        };
+      }
+    }
+
+    const news = listNews({ symbol: sym, hours: 24 * 30, limit: 20 });
+    const sortedDivs = [...(divs || [])].sort((a, b) => String(b.registry).localeCompare(String(a.registry)));
+
+    res.json({
+      symbol: sym,
+      name: fcRow?.name || vocabHit?.name || sym,
+      price: round(curPrice, curPrice < 1 ? 5 : curPrice < 10 ? 3 : 2),
+      dayChangePct,
+      monthChangePct,
+      yearChangePct,
+      tier: isTier1 ? 1 : 2,
+      tierLabel: isTier1 ? '1-й эшелон (высокая ликвидность)' : '2-й эшелон',
+      edgeMult: fcRow?.edgeMult ?? round(tierMult, 3),
+      sigmaPct: fcRow?.sigmaPct ?? null,
+      buyThresholdPct: fcRow?.buyThresholdPct ?? round(Math.max((fc?.buyThresholdPct || 0.40) * tierMult, 0.30), 3),
+      shortThresholdPct: fcRow?.shortThresholdPct ?? round(Math.max((fc?.shortThresholdPct || 0.50) * tierMult, 0.31), 3),
+      shortAllowedByBroker: shortableMap[sym] !== undefined ? Boolean(shortableMap[sym]) : null,
+      specs: {
+        lotSize: sp.lotSize,
+        lotCostRub: round((sp.lotSize || 1) * curPrice, 2),
+        minStep: sp.minStep,
+        decimals: sp.decimals,
+        issueSize: sp.issueSize || null,
+        marketCapRub,
+        indexWeightPct: vocabHit?.weight ? round(vocabHit.weight, 2) : null,
+      },
+      forecast: fcRow ? {
+        bar: fc?.bar,
+        horizonHours: fc?.horizon || 2.5,
+        expectedPct: fcRow.expectedPct,
+        lastMovePct: fcRow.lastMovePct ?? 0,
+        deltaPct: fcRow.deltaPct || 0,
+        signal: Boolean(fcRow.signal),
+        shortSignal: Boolean(fcRow.shortSignal),
+        shortBlockedByBroker: Boolean(fcRow.shortBlockedByBroker),
+        shortBlockedBySqueeze: Boolean(fcRow.shortBlockedBySqueeze),
+        buyBlockedByDip: Boolean(fcRow.buyBlockedByDip),
+        buyBlockedByDiv: fcRow.buyBlockedByDiv || null,
+        shortBlockedByDiv: fcRow.shortBlockedByDiv || null,
+        buyBlockedByNews: fcRow.buyBlockedByNews || null,
+        shortBlockedByNews: fcRow.shortBlockedByNews || null,
+        selfPct: fcRow.selfPct ?? 0,
+        influences: (fcRow.influences || []).map((inf) => {
+          const infRow = fc?.rows?.find((x) => x.symbol === inf.symbol);
+          return { ...inf, name: infRow?.name || inf.symbol, price: infRow?.price || null, expectedPct: infRow?.expectedPct ?? null };
+        }),
+      } : null,
+      traits,
+      dividends: sortedDivs,
+      news,
+      userPositions,
+      userOperations: userOperations.slice(0, 60),
+      backtestStat,
+      intraday1m,
+      intraday,
+      daily,
+    });
+  }));
+
+  // ---------- Журнал гипотез ----------
+  r.get('/journal', (req, res) => res.json(listJournal(500)));
+  r.post('/journal', wrap((req, res) => {
+    const id = addJournal({ ...req.body, source: 'user' });
+    hub.emit({ type: 'journal:update' });
+    res.json({ id });
+  }));
+  r.delete('/journal/:id', (req, res) => { deleteJournal(Number(req.params.id)); hub.emit({ type: 'journal:update' }); res.json({ ok: true }); });
+
+  // ---------- Чат со Стратегом ----------
+  r.get('/chat', (req, res) => res.json(strategist.history()));
+  r.post('/chat/send', wrap((req, res) => {
+    const plan = effectivePlan();
+    if (countUserChatToday() >= plan.maxChatPerDay) {
+      throw new Error(`Достигнут дневной лимит сообщений ИИ-Стратегу по лицензии «${plan.name}» (${plan.maxChatPerDay} в сутки).`);
+    }
+    const { text, mode, newSession, title } = req.body || {};
+    res.json({ message: strategist.sendUserMessage(text, mode, { newSession: Boolean(newSession), title: title || null }) });
+  }));
+  r.post('/chat/action', wrap((req, res) => {
+    const { msgId, callId, decision, comment } = req.body || {};
+    strategist.resolveAction(Number(msgId), String(callId), decision, comment);
+    res.json({ ok: true });
+  }));
+  r.post('/chat/stop', (req, res) => { strategist.stopAgent(); res.json({ ok: true }); });
+  r.post('/chat/mode', wrap((req, res) => { strategist.setMode(req.body?.mode, req.body?.budget); res.json(strategist.chatState()); }));
+  r.post('/chat/new', (req, res) => { strategist.resetConversation(); res.json(strategist.history()); });
+  r.get('/chat/archive', (req, res) => res.json({ sessions: strategist.listArchivedSessions(120) }));
+  r.post('/chat/archive/:id/open', wrap((req, res) => res.json(strategist.openArchivedSession(Number(req.params.id)))));
+  r.get('/chat/archive/:id/md', wrap((req, res) => {
+    const info = strategist.exportConversationMarkdown(Number(req.params.id));
+    if (!info) throw Object.assign(new Error('Сессия не найдена или пуста'), { status: 404 });
+    res.json(info);
+  }));
+
+  return r;
+}