Phase 2 WIP: Cashu payment endpoints, session tracking, updated checklist

- Add cashu.c/h: Cashu token decode (cashuA/base64url), proof state check via mint API, allotment calculator
- Add session.c/h: time-based session management with allotment/expiry, spent secret tracking
- Add tollgate_api.c/h: HTTP server on :2121 with GET / (kind=10021 discovery), POST / (payment processing), /usage, /whoami
- Update captive portal HTML: replace Grant Free Access with Cashu token paste form + Pay & Connect button
- Update tollgate_main.c: wire in session manager, TollGate API, 1s session tick loop
- Add tests/phase2.mjs: Phase 2 test suite (discovery, invalid token, wrong mint, valid payment)
- Update CHECKLIST.md: reflect Phase 1 complete, Phase 2 in progress with known bugs

Known issues (not yet flashed):
- Stack overflow crash in httpd POST handler (need stack_size=16384 + heap allocations)
- cashu_decode_token uses 2KB stack buffer (needs heap alloc)
- Mint URL should be testnut.cashu.space (nofee.testnut has API compat issues)

1 files changed, 42 insertions, 0 deletions

diff --git a/main/cashu.h b/main/cashu.h
new file mode 100644
index 0000000..17891c5
--- /dev/null
+++ b/main/cashu.h
@@ -0,0 +1,42 @@
+#ifndef CASHU_H
+#define CASHU_H
+
+#include "esp_err.h"
+#include <stdint.h>
+#include <stdbool.h>
+
+#define CASHU_MAX_PROOFS      10
+#define CASHU_MAX_SECRET_LEN  128
+#define CASHU_MAX_ID_LEN      16
+#define CASHU_MAX_C_LEN       128
+
+typedef struct {
+    uint64_t amount;
+    char id[CASHU_MAX_ID_LEN];
+    char secret[CASHU_MAX_SECRET_LEN];
+    char c[CASHU_MAX_C_LEN];
+} cashu_proof_t;
+
+typedef struct {
+    cashu_proof_t proofs[CASHU_MAX_PROOFS];
+    int proof_count;
+    char mint_url[256];
+    uint64_t total_amount;
+} cashu_token_t;
+
+typedef struct {
+    char y_hex[65];
+    bool spent;
+} cashu_proof_state_t;
+
+esp_err_t cashu_decode_token(const char *token_str, cashu_token_t *out);
+
+esp_err_t cashu_check_proof_states(const char *mint_url, const cashu_token_t *token,
+                                   cashu_proof_state_t *states, int *state_count);
+
+uint64_t cashu_calculate_allotment_ms(uint64_t token_amount, uint64_t price_per_step,
+                                       uint64_t step_size_ms);
+
+bool cashu_is_mint_accepted(const char *mint_url);
+
+#endif