README:
- Default network is testnet; add a table of the integrations that are
  tied to specific networks (NFD, Pera, Tinyman, Haystack, Alpha, x402,
  Bazaar).
- List all 8 environment variables the server reads.
- Drop the wallet resources, AP2 and Zod-validation claims; describe the
  13 knowledge resources, document keys and the '~' file names.
- Describe the wallet migration, archiving and persistence as the code
  does them, and x402 in V2 terms (PAYMENT-REQUIRED, PAYMENT-SIGNATURE,
  PAYMENT-RESPONSE, amount), with V1 names as fallbacks.
- Pagination applies only to api_* and alpha_* tools.
- Fix the Claude Code, Codex CLI and OpenCode setup instructions.
- Update the project tree, test tables and counts, E2E notes (the
  wallet suite writes to ~/.algorand-mcp/wallet.db; run with a scratch
  HOME), and the dependency list: correct repository links, pinned
  Alpha SDK, base64-js, the vendored Tinyman SDK, and removed packages.

api_indexer_search_for_assets: the indexer dispatch overwrote the
caller's `name` argument with the tool name, so every search, by name,
unit or creator, also filtered for an asset named after the tool and
returned nothing. The caller's value now reaches the indexer, with a
unit test that fails on the old code.

The knowledge E2E test requested the key "ARCs", which is not a
document, and passed either way. It now reads arcs:specs:arc-0090.md
and checks that an unknown key is rejected.

- Ship the compiled @tinymanorg/tinyman-js-sdk 5.1.5 (MIT, unmodified,
  with its license) in vendor/ instead of depending on the npm package,
  whose deprecated uuid@10 dependency made Socket block installs. The
  bundle already contains the uuid v4 code it uses and loads only
  algosdk, base64-js and crypto, so base64-js becomes a direct
  dependency. uuid and multiformats are no longer installed.
- Pin @alpha-arcade/sdk to 0.5.2 (was "latest").
- Raise zod to ^4.6.7 for CVE-2023-54404 (GHSA-mrhx-c7xc-m3w5).
  src/types.ts uses the two-argument z.record() that zod 4 requires.
- Remove dependencies that nothing imports: @cf-wasm/photon,
  @juit/qrcode, algo-msgpack-with-bigint, hi-base32, just-pick, qrcode
  and @types/qrcode, together with the commented-out local QR code.
- Rename the 804 knowledge files from ':' to '~' as the separator,
  because ':' is invalid in Windows file names. Document keys do not
  change; get_knowledge_doc maps keys to files.
- Remove three index entries that returned no content:
  algo-models:README.md has no file, and two keys pointed to empty
  files. Tests now check that every listed key opens with content and
  that every file name is valid on Windows.
- generate_algorand_qrcode: emit the canonical address form, accept
  amount and asset as decimal strings up to the uint64 maximum, and
  omit the expiry line when QRClaw reports none. Add ARC-82 to the
  knowledge base.
- package.json: add repository, homepage and bugs fields, ship vendor/,
  version 4.4.4.

129 entries in the clis, sdks and tealscript category indexes pointed to
files that do not exist in taxonomy/, and 18 subcategories held only
such entries. Remove both so every advertised key can be opened. The
removed entries are recorded locally for re-adding with their files.

* feat(passkey): sign for accounts rekeyed to the passkey account

An account rekeyed to the passkey's address (a legacy ed25519 account moved
to a post-quantum key, keeping its address and history) can now be added to
the passkey wallet and signed for like the passkey's own account.

- addRekeyedAccount(address) checks algod's auth-addr and adds the account
  (error code `not-rekeyed` when it isn't rekeyed to the passkey);
  removeRekeyedAccount(address) drops it; passkeyAddress is the passkey's
  own address.
- The wallet record keeps rekeyed accounts per network (genesis hash, else
  network ID); old records still load, and bad or duplicate entries are
  dropped. Switching networks shows that network's accounts, and a resumed
  session reconciles with the record instead of disconnecting.
- signTransactions signs a transaction whose sender is the passkey's own
  address, a rekeyed account, or an account a txn earlier in the same group
  rekeys to the passkey (only when the group has a group ID). A rekeyed
  account's signatures and its empty signature name the passkey as sgnr.
- signData signs for a rekeyed account; core createStdSignData(data,
  address) refuses an address the wallet doesn't hold (SignDataError 4100).

* fix(core): wait for a rekey to the PQ key that algod hasn't shown yet

Right after addRekeyedAccount, a lagging algod read (no auth-addr yet)
made the manager clear the account's empty signature, and signData
refused it with 4603.

- The manager re-checks an account whose empty signature names its PQ
  key as sgnr while algod shows no rekey, three times 2 s apart, before
  clearing it. A check in between waits for the retry already scheduled.
- createStdSignData asks algod again three times 1 s apart in the same
  case before answering 4603.
- The passkey adapter keeps the active account on sign-in again, so a
  rekeyed account stays active.
- An opt-in LocalNet test (LOCALNET_E2E=1) runs the migration group with
  a real Falcon key: the rekey and the passkey's proof in one group, then
  a transaction and SIWA for the account; a wrong passkey's proof fails
  the group; no proof is signed for a group that rekeys elsewhere.

---------

Co-authored-by: Patrick Bennett <170563+pbennett@users.noreply.github.com>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [gradle-wrapper](https://github.com/gradle/gradle) from 9.8.2 to 9.9.0.
- [Release notes](https://github.com/gradle/gradle/releases)
- [Commits](https://github.com/gradle/gradle/compare/v9.8.2...v9.9.0)

---
updated-dependencies:
- dependency-name: gradle-wrapper
  dependency-version: 9.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>