ECLIPSPAY — DEPLOYMENT BUNDLE  (latest)
=======================================

WHERE EACH FILE GOES  (server path: public_html/api/v1/)
--------------------------------------------------------
api.php          -> api/v1/api.php        (receipts + all webhooks + notifications)
providers.php    -> api/v1/providers.php  (Bitnob HMAC + POST /api/addresses; swap/cards)
palmpay.php      -> api/v1/palmpay.php    (PalmPay RSA signing engine)
config.php       -> api/v1/config.php     (CORRECTED config: db creds + brand block)
admin/index.php  -> api/v1/admin/index.php(admin dashboard SPA)

diagnostics/     -> run once via SSH/terminal, THEN DELETE from server
  pptest.php          php pptest.php   (PalmPay: bank list + create virtual account)
  bntest.php          php bntest.php   (Bitnob: whoami + generate USDT address)
  palmpay-keygen.php  derives the PalmPay public key from your stored private key

receipt-preview.html  -> NOT for server. Open in any browser to see the receipt design.


NEW: TRANSACTION RECEIPTS
-------------------------
Endpoint:  GET  api.php?path=receipt&tx=<TX_ID>&t=<64-char-auth-token>
- Renders a styled HTML receipt (logo, watermark, rubber-stamp, amount, ref, date).
- Opens in any webview/browser; "Download / Print" button uses the print dialog.
- Auth: pass the user's auth token via ?t= (or Authorization: Bearer header).
- The tx must belong to that user, else "Receipt not found".
In the app, link to:  {api_base}?path=receipt&tx=<id>&t=<token>


WEBHOOK URLs TO SET IN DASHBOARDS
---------------------------------
PalmPay (Notify URL field + payout/bill callbacks):
  payin :  https://eclipspay.cloud/api/v1/api.php?path=palmpay/payin
  payout:  https://eclipspay.cloud/api/v1/api.php?path=palmpay/payout
  bill  :  https://eclipspay.cloud/api/v1/api.php?path=palmpay/bill

Bitnob (Dashboard -> Webhooks, subscribe deposit.success + transfer.success/failed):
  https://eclipspay.cloud/api/v1/api.php?path=bitnob/webhook


ONE-TIME SQL (phpMyAdmin -> SQL)
--------------------------------
-- Bitnob base + (optional) webhook signing secret
INSERT INTO settings (k,v) VALUES
 ('prov_bitnob_base_url','https://api.bitnob.com')
 ON DUPLICATE KEY UPDATE v=VALUES(v);
-- after copying Bitnob's webhook secret from the dashboard:
INSERT INTO settings (k,v) VALUES
 ('prov_bitnob_webhook_secret','PASTE_SECRET_HERE')
 ON DUPLICATE KEY UPDATE v=VALUES(v);


NOTIFICATIONS — WHAT WORKS HOW
------------------------------
In-app Alerts feed: 100% backend, already wired. Every webhook calls notify()
  which writes a row the app reads via GET notifications. Appears in Alerts tab
  once a webhook actually fires (so set the URLs above + do a live transaction).

Push banners (popup when app closed): needs FCM, NOT backend-only:
  1) service-account.json  next to config.php in api/v1/
  2) google-services.json  baked into the Android build
  3) a device token (app registers on login once the above are in place)
  Missing any one => push silently does nothing (in-app alert still saved).


AFTER GO-LIVE CLEANUP
---------------------
Delete from server:  diagnostics/pptest.php, diagnostics/bntest.php,
                     diagnostics/palmpay-keygen.php  (they touch keys).
