fix: restore security hardening compatibility and validation

Restore authorized rule reveal, explicit full HTTP capture and retention, video task business fields, and valid payment URLs. Add opt-in credential preservation for trusted recovery, fix frontend type contracts and async races, and eliminate PostgreSQL test fixture resource leaks. Document audit coverage and successful fmt and CI-scoped Clippy checks.

frontend/src/views/user/WalletCenter.vue

@@ -112,7 +112,7 @@
           </div>
           <RefreshButton
             :loading="loadingOrders || loadingTransactions"
-            @click="() => Promise.all([loadBalance(), loadOrders(), loadTransactions()])"
+            @click="refreshWallet"
           />
         </div>
 
@@ -942,6 +942,10 @@ watch(refundableOrders, () => {
   syncRefundOrderSelection()
 })
 
+async function refreshWallet() {
+  await Promise.all([loadBalance(), loadOrders(), loadTransactions()])
+}
+
 async function loadBalance() {
   walletBalance.value = await walletApi.getBalance()
 }