docs+web: refresh CLAUDE.md/README to current state; operator /admin console

- CLAUDE.md: replaced stale "scaffold only" with an accurate Built / In progress /
  Not-built status; added a Secrets section; updated dev commands + pm2/.env notes.
- README.md: roadmap reflects v0.1–v0.4 working (clean→burn→fee→Essence→Prometheus),
  sell=detection-only, v1.0 pending; quick-start + secrets accurate.
- apps/web /admin: operator console — paste admin token (sessionStorage, never
  baked/committed), generate Spawns (chaos/seed/receiptId) + record manual Pump.fun
  launches; 403 re-prompts. Public route, gated by the API token.

web build green (+/admin). Status site already redeployed (Phase 4 updated).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

README.md

@@ -5,11 +5,15 @@
 **Links:** [feedthepyre.com](https://feedthepyre.com) · repo: `git.lumiai.dev/RogueWave/pyre` · dev status: [feedthepyre.com](https://feedthepyre.com) (status dashboard)
 
 PYRE is a **Solana wallet-cleanup and ritual meme-rebirth protocol**. You connect
-a wallet; PYRE scans your SPL token accounts, classifies them conservatively, and
-helps you safely close empty associated token accounts (ATAs) and burn obvious
-junk — **returning recovered rent to you** and producing a clear, shareable
-receipt. A later layer (Prometheus) uses AI to generate a meme-token "Spawn" from
-burned remnants for **manual, human-reviewed** launch.
+a wallet; PYRE scans your SPL token accounts (classic **and** Token-2022),
+classifies them conservatively, and helps you safely close empty associated token
+accounts (ATAs) and burn obvious junk — **returning recovered rent to you** (minus
+a transparent 5% protocol fee) and producing a clear, shareable receipt. The
+Prometheus engine uses AI to generate a meme-token "Spawn" from burned remnants
+for **manual, human-reviewed** launch on Pump.fun.
+
+The burner core is **live at [feedthepyre.com](https://feedthepyre.com)** and the
+5%-fee close/burn flow has been verified end-to-end on mainnet.
 
 The first emotional win is simple: *"PYRE cleaned my wallet and returned SOL I
 forgot was trapped in token accounts."*
@@ -26,8 +30,10 @@ promises.
 
 **Trust guarantees:** PYRE never holds your private keys, never signs
 custodially, and always shows a decoded transaction preview that matches what you
-sign. Recovered rent goes back to your wallet by default. Anything the system
-cannot safely reason about is skipped.
+sign. Recovered rent goes back to your wallet, minus a single **transparent 5%
+protocol fee** shown before you sign (it funds the Spawn — see the roadmap).
+Swap proceeds always go to you. Anything the system cannot safely reason about is
+skipped.
 
 ## The burner flow at a glance
 
@@ -35,25 +41,34 @@ cannot safely reason about is skipped.
 Connect wallet
  → scan token accounts
  → classify accounts (closeable / burnable / transmutable / protected / unsupported)
- → preview the transaction (accounts, rent, destination, fees, warnings)
+ → preview the transaction (accounts, rent, destination, 5% fee, warnings)
  → you sign locally in your wallet
- → recovered rent returns to you
+ → recovered rent (minus the fee) returns to you; the fee feeds the PYRE
  → see your PYRE receipt
 ```
 
-## Roadmap
+## Roadmap & status
 
-- **v0.1 — Burner / Cleaner** *(current focus)*: wallet connect, scan, classify,
-  close empty ATAs, optional junk burn, rent return, receipt.
-- **v0.2 — Prometheus Meta Mixer**: AI generation of a Spawn identity from
-  burned/cleaned token context (candidate package only — no auto-launch).
-- **v0.3 — Manual Pump.fun Workflow**: human reviews the Spawn package and
-  manually creates the token; PYRE records mint, URL, metadata, and tx.
-- **v0.4 — Essence Ledger**: record net SOL value of safe scrap swaps as Essence
-  per wallet/round (database-only, experimental, no claim promises).
-- **v1.0 — PYRE Core Program**: custom Solana (Anchor) program for trust-critical
-  accounting — rounds, Essence vault, contribution receipts, Spawn distribution,
-  claims, and refunds.
+- **v0.1 — Burner / Cleaner** — **working.** Wallet connect, scan, conservative
+  classification (classic SPL + Token-2022 with extension gating), close empty
+  ATAs, burn-then-close junk, rent return minus the transparent 5% fee, receipt.
+  Live on mainnet.
+- **v0.2 — Prometheus Meta Mixer** — **working.** AI generation of a Spawn
+  identity (name/ticker/lore/tagline/image-prompt + safety) from burned/cleaned
+  token context; provider-abstracted with a deterministic stub fallback. Produces
+  a candidate package only — no auto-launch. *In progress:* admin review UI and
+  finishing the receipt → generation wiring.
+- **v0.3 — Manual Pump.fun Workflow** — **working (manual, approval-gated).**
+  Admin-gated generate/launch endpoints record mint, URL, metadata, and tx; public
+  `/spawn` page. Human creates the token.
+- **v0.4 — Essence Ledger** — **working (database-only).** The on-chain 5% fee is
+  recorded as Essence per round in Postgres; a public "🔥 fed the PYRE" panel and
+  `/api/essence` show round progress. Experimental, no claim promises.
+- **Sell / Transmute** — **detection only.** Jupiter quotes + Shield + dust gate
+  classify TRANSMUTABLE tokens; swap **execution is not built yet**.
+- **v1.0 — PYRE Core Program** — **not built.** Future Solana (Anchor) program for
+  trust-critical accounting: rounds, Essence vault, contribution receipts, Spawn
+  distribution, claims, refunds.
 
 ## Repo structure
 
@@ -61,7 +76,7 @@ Connect wallet
 apps/
   web/        Next.js user app (wallet connect, scanner, preview, receipt)
   api/        Fastify HTTP API (scan, classify, build tx, receipt, generation)
-  worker/     BullMQ background worker (metadata, AI, safety, confirmations)
+  worker/     BullMQ background worker (skeleton — jobs not yet wired)
 packages/
   core/       shared types, classification enums, risk rules, schemas
   solana/     token-account parsing, close/burn tx builders, decoder, simulation
@@ -75,17 +90,20 @@ docs/         design, architecture, security, classification
 
 ## Quick start
 
-> **This is a scaffold.** The commands below are not yet runnable — the workspace
-> package definitions and source are still being built out.
-
 **Prerequisites:** Node 22, pnpm, PostgreSQL, Redis.
 
 ```bash
 cp .env.example .env   # then fill in values (no private keys — by design)
 pnpm install
-pnpm dev               # (once apps are implemented)
+pnpm -r build          # build all packages/apps
+pnpm -r test           # run the test suites
+pnpm dev               # run web + api in dev
 ```
 
+Secrets are read from the gitignored `.env` at the repo root; never commit keys.
+Admin endpoints require an `ADMIN_API_TOKEN` (see `.env.example`). In production
+the apps run under pm2 (`ecosystem.config.cjs`).
+
 ## Docs
 
 See [`docs/`](docs/) — start with