Wallet & Activity Picker ID Hardening

Fix

Week of April 20, 2026

A privacy and security hardening pass:

Wallet forms and the activity picker no longer expose internal numeric database IDs in URLs or form fields
Community Admin routes use opaque ULIDs instead of sequential integers, so admin IDs can’t be guessed or enumerated

No action required — this is a transparent improvement.