invoices: payout addresses in the database

Default crypto payout addresses lived in the CRYPTO_ADDRESSES and
LTC_ADDRESS Forgejo secrets, so changing one meant editing a secret and
redeploying. Keep them in a payout_addresses table edited at
/admin/invoices/payout-addresses (read to view, write to change, every
change audited), and prefill the new-invoice form from it.

The old env values are imported once on the first boot with an empty
table, so the current addresses carry over; after that the secrets can
be removed.

Assisted-by: Claude:opus-5

asxpio.rb

@@ -40,6 +40,8 @@ if ENV['DATABASE_URL']
   Bingo.seed!
   require_relative 'lib/user'
   require_relative 'lib/audit'
+  require_relative 'lib/payout_address'
+  PayoutAddress.seed_from_env!
   User.bootstrap!(ENV['ADMIN_USER'], ENV['ADMIN_PASSWORD'])
 else
   $logger.warn('DATABASE_URL not set — invoicing disabled')
@@ -220,6 +222,27 @@ class AsxpioWeb < Sinatra::Base
     end
   end
 
+  # Defined before /admin/invoices/:uuid, which would otherwise match it.
+  get '/admin/invoices/payout-addresses' do
+    @page_title = 'Payout addresses · admin'
+    @noindex    = true
+    @addresses  = PayoutAddress.as_hash(:coin)
+    @flash      = session.delete(:payout_flash)
+    erb :'admin/invoices/payout_addresses'
+  end
+
+  post '/admin/invoices/payout-addresses' do
+    before = PayoutAddress.map
+    errors = CryptoAsset::CODES.filter_map do |coin|
+      next unless params.dig('address', coin)
+      PayoutAddress.set!(coin, params['address'][coin], by: current_user.username)
+    end
+    changed = (before.keys | PayoutAddress.map.keys).reject { |c| before[c] == PayoutAddress.map[c] }
+    audit!('invoice.payout_addresses', changed.join(', '), nil) if changed.any?
+    session[:payout_flash] = errors.any? ? errors.join('; ') : "Saved#{" (#{changed.join(', ')})" if changed.any?}."
+    redirect '/admin/invoices/payout-addresses'
+  end
+
   get '/admin/invoices/new' do
     @page_title  = 'New invoice · admin'
     @noindex     = true