feat: explorer API, wallet, CCIP scripts, and config refresh

- Backend REST/gateway/track routes, analytics, Blockscout proxy paths.
- Frontend wallet and liquidity surfaces; MetaMask token list alignment.
- Deployment docs, verification scripts, address inventory updates.

Check: go build ./... under backend/ (pass).
Made-with: Cursor

backend/api/rest/swagger.yaml

@@ -41,6 +41,8 @@ tags:
     description: Unified search endpoints
   - name: Track1
     description: Public RPC gateway endpoints (no auth required)
+  - name: MissionControl
+    description: Public mission-control health, bridge trace, and cached liquidity helpers
   - name: Track2
     description: Indexed explorer endpoints (auth required)
   - name: Track3
@@ -232,6 +234,105 @@ paths:
               schema:
                 $ref: '#/components/schemas/BlockListResponse'
 
+  /api/v1/mission-control/stream:
+    get:
+      tags:
+        - MissionControl
+      summary: Mission-control SSE stream
+      description: |
+        Server-Sent Events stream with the same inner `data` payload as `GET /api/v1/track1/bridge/status`.
+        Emits one event immediately, then refreshes every 20 seconds. Configure nginx with `proxy_buffering off`.
+      operationId: getMissionControlStream
+      responses:
+        '200':
+          description: SSE stream
+          content:
+            text/event-stream:
+              schema:
+                type: string
+
+  /api/v1/mission-control/liquidity/token/{address}/pools:
+    get:
+      tags:
+        - MissionControl
+      summary: Cached liquidity proxy
+      description: |
+        30-second in-memory cached proxy to the token-aggregation pools endpoint for the configured `CHAIN_ID`.
+      operationId: getMissionControlLiquidityPools
+      parameters:
+        - name: address
+          in: path
+          required: true
+          schema:
+            type: string
+            pattern: '^0x[a-fA-F0-9]{40}$'
+      responses:
+        '200':
+          description: Upstream JSON response
+        '400':
+          $ref: '#/components/responses/BadRequest'
+        '503':
+          description: `TOKEN_AGGREGATION_BASE_URL` not configured
+
+  /api/v1/mission-control/bridge/trace:
+    get:
+      tags:
+        - MissionControl
+      summary: Resolve a transaction through Blockscout and label 138-side contracts
+      description: |
+        Queries Blockscout using `BLOCKSCOUT_INTERNAL_URL` and labels the `from` and `to` addresses using Chain 138 entries from `SMART_CONTRACTS_MASTER_JSON`.
+      operationId: getMissionControlBridgeTrace
+      parameters:
+        - name: tx
+          in: query
+          required: true
+          schema:
+            type: string
+            pattern: '^0x[a-fA-F0-9]{64}$'
+      responses:
+        '200':
+          description: Labeled bridge trace
+        '400':
+          $ref: '#/components/responses/BadRequest'
+        '502':
+          description: Blockscout lookup failed
+
+  /api/v1/track4/operator/run-script:
+    post:
+      tags:
+        - Track4
+      summary: Run an allowlisted operator script
+      description: |
+        Track 4 endpoint. Requires authenticated wallet, IP allowlisting, `OPERATOR_SCRIPTS_ROOT`, and `OPERATOR_SCRIPT_ALLOWLIST`.
+      operationId: runOperatorScript
+      security:
+        - bearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [script]
+              properties:
+                script:
+                  type: string
+                  description: Path relative to `OPERATOR_SCRIPTS_ROOT`
+                args:
+                  type: array
+                  items:
+                    type: string
+                  maxItems: 24
+      responses:
+        '200':
+          description: Script execution result
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '403':
+          $ref: '#/components/responses/Forbidden'
+        '503':
+          description: Script root or allowlist not configured
+
   /api/v1/track2/search:
     get:
       tags:
@@ -427,4 +528,3 @@ components:
             error:
               code: "internal_error"
               message: "An internal error occurred"
-