market: self-heal orphan stalls — re-publish kind-30017 when user has merchant but no stall on relay
security: add CSP + standard security headers in nginx (demo + prod)
auth: validate URL-supplied token before persisting + tighten guards to require populated user
Pre-commit secret-scan hook: false positive on prvkey field accesses
Adopt the events-style "log in to do this" toast in forum / market / tasks
Operator-configurable public-vs-private mode per standalone (forum, market, tasks, activities)
Feature: generate a printable PDF menu (with QR ideas)