fix: SSE streaming for no-tool path, batch ticker API, security & cleanup

- Fix thinkAndActStream: emit delta event for non-tool responses (was silent)
- Add fallback to streaming on first LLM call failure
- Add batch ticker endpoint /api/agent/tickers (3 API calls → 1)
- Update MarketTicker to use batch endpoint, remove unused state
- Warn loudly when JWT_SECRET uses default value
- Fix 华为 mapping (was incorrectly mapped to Tencent)
- Replace ioutil.ReadAll with safe.ReadAllLimited in nofxos client
- Remove unused variable in hyperliquid trader_account
- Wrap CoinAnk WS readers with safe.GoNamed for panic recovery
- Use 100dvh for mobile viewport in AgentChatPage
- console.log → console.warn for auth events

provider/coinank/coinank_api/depth_ws.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"nofx/provider/coinank/coinank_enum"
+	"nofx/safe"
 
 	"golang.org/x/net/websocket"
 )
@@ -79,7 +80,7 @@ func depth_ws(ctx context.Context) (*websocket.Conn, <-chan *WsResult[DepthV3],
 		return nil, nil, err
 	}
 	ch := make(chan *WsResult[DepthV3], 1024)
-	go depth_read(conn, ch)
+	safe.GoNamed("coinank-depth-ws-reader", func() { depth_read(conn, ch) })
 	return conn, ch, nil
 }
 

provider/coinank/coinank_api/kline_ws.go

@@ -86,7 +86,7 @@ func ws(ctx context.Context) (*websocket.Conn, <-chan string, error) {
 		return nil, nil, err
 	}
 	ch := make(chan string, 1024)
-	go read(conn, ch)
+	safe.GoNamed("coinank-ws-reader", func() { read(conn, ch) })
 	return conn, ch, nil
 }
 

provider/nofxos/client.go

@@ -4,8 +4,8 @@
 package nofxos
 
 import (
-	"io/ioutil"
 	"net/http"
+	"nofx/safe"
 	"nofx/security"
 	"strings"
 	"sync"
@@ -108,7 +108,7 @@ func (c *Client) doRequest(endpoint string) ([]byte, error) {
 	}
 	defer resp.Body.Close()
 
-	body, err := ioutil.ReadAll(resp.Body)
+	body, err := safe.ReadAllLimited(resp.Body, 0)
 	if err != nil {
 		return nil, err
 	}