Merge kms-nonce-bind-2026-04-28

# Conflicts:
#	CHANGELOG.md

pkg/api/server.go

@@ -16,7 +16,6 @@ import (
 	"github.com/luxfi/mpc/pkg/custody"
 	"github.com/luxfi/mpc/pkg/db"
 	"github.com/luxfi/mpc/pkg/txtracker"
-	"github.com/luxfi/mpc/pkg/wallet"
 	"github.com/luxfi/mpc/pkg/webauthn"
 )
 
@@ -85,18 +84,6 @@ type Server struct {
 	router         chi.Router
 	replayGuard    *replayGuard
 
-	// tieredWallets is the registry for the 9-tier wallet architecture
-	// (pkg/wallet). Lazily initialized to NewInMemoryRegistry() on first
-	// use. Tests / production wrappers can install a custom Registry via
-	// SetTieredWalletRegistry.
-	tieredWallets wallet.Registry
-
-	// approval holds the pluggable executive-approval registry
-	// (pkg/approval). Optional — when nil, /v1/approval/* returns 503.
-	// Wire via Server.SetApproval after constructing the providers + the
-	// orchestrator binding map.
-	approval *ApprovalRegistry
-
 	// Events is the broadcast channel for server-side events (intent status,
 	// signing progress, wallet events). Handlers publish here; WebSocket
 	// clients and ZAP subscribers receive.
@@ -507,35 +494,6 @@ func NewServer(database *db.Database, mpcBackend MPCBackend, jwtSecret string, o
 						Post("/sign", s.handleTreasurySign)
 				})
 			})
-
-			// /v1/wallet/* — 9-tier wallet architecture (pkg/wallet).
-			// Distinct from /v1/mpc/wallets (Liquidity MPC spec) and
-			// /v1/mpc/treasury (3-of-5 governance). One purpose per surface.
-			// Tier-aware sign dispatch + domain-separation enforcement.
-			r.Route("/wallet", func(r chi.Router) {
-				r.With(requireRoleOrAPIPermission([]string{"owner", "admin"}, "mpc:wallet:tier:write")).
-					Post("/", s.handleTieredWalletCreate)
-				r.Get("/{id}", s.handleTieredWalletGet)
-				r.Get("/tier/{tier}", s.handleTieredWalletListByTier)
-				r.With(requireRoleOrAPIPermission([]string{"owner", "admin", "signer"}, "mpc:wallet:tier:sign"), RateLimitMiddleware(20)).
-					Post("/{id}/sign", s.handleTieredWalletSign)
-				r.Get("/{id}/balance", s.handleTieredWalletBalance)
-				r.Get("/{id}/usage", s.handleTieredWalletUsage)
-			})
-
-			// /v1/approval/* — executive approval flow (pkg/approval).
-			// Approvals are SEPARATE from MPC signing: out-of-band
-			// (Ledger Enterprise / WebAuthn / KMS / Safe) attest that an
-			// authorized human approved the intent before MPC nodes sign
-			// the chain transaction. No /api/ prefix per house style.
-			r.Route("/approval", func(r chi.Router) {
-				r.With(requireRoleOrAPIPermission([]string{"owner", "admin", "signer"}, "mpc:approval:submit")).
-					Post("/intent", s.handleApprovalSubmit)
-				r.Get("/intent/{id}/status", s.handleApprovalStatus)
-				r.With(requireRoleOrAPIPermission([]string{"owner", "admin", "signer"}, "mpc:approval:cast")).
-					Post("/intent/{id}/cast", s.handleApprovalCast)
-				r.Get("/intent/{id}/bundle", s.handleApprovalBundle)
-			})
 		})
 	})