Phase 2 WIP: Cashu payment endpoints, session tracking, updated checklist

- Add cashu.c/h: Cashu token decode (cashuA/base64url), proof state check via mint API, allotment calculator
- Add session.c/h: time-based session management with allotment/expiry, spent secret tracking
- Add tollgate_api.c/h: HTTP server on :2121 with GET / (kind=10021 discovery), POST / (payment processing), /usage, /whoami
- Update captive portal HTML: replace Grant Free Access with Cashu token paste form + Pay & Connect button
- Update tollgate_main.c: wire in session manager, TollGate API, 1s session tick loop
- Add tests/phase2.mjs: Phase 2 test suite (discovery, invalid token, wrong mint, valid payment)
- Update CHECKLIST.md: reflect Phase 1 complete, Phase 2 in progress with known bugs

Known issues (not yet flashed):
- Stack overflow crash in httpd POST handler (need stack_size=16384 + heap allocations)
- cashu_decode_token uses 2KB stack buffer (needs heap alloc)
- Mint URL should be testnut.cashu.space (nofee.testnut has API compat issues)

1 files changed, 44 insertions, 0 deletions

diff --git a/main/session.h b/main/session.h
new file mode 100644
index 0000000..e7d78d4
--- /dev/null
+++ b/main/session.h
@@ -0,0 +1,44 @@
+#ifndef SESSION_H
+#define SESSION_H
+
+#include "esp_err.h"
+#include <stdint.h>
+#include <stdbool.h>
+
+#define SESSION_MAX_CLIENTS     10
+#define SESSION_MAX_MAC_LEN     18
+
+typedef struct {
+    uint32_t client_ip;
+    char mac[SESSION_MAX_MAC_LEN];
+    uint64_t allotment_ms;
+    int64_t start_time_ms;
+    bool active;
+    char spent_secrets[5][65];
+    int spent_secret_count;
+} session_t;
+
+esp_err_t session_manager_init(void);
+
+session_t *session_create(uint32_t client_ip, uint64_t allotment_ms,
+                          const char *spent_secrets[], int secret_count);
+
+session_t *session_find_by_ip(uint32_t client_ip);
+
+void session_extend(session_t *session, uint64_t additional_ms);
+
+bool session_is_expired(const session_t *session);
+
+bool session_is_secret_spent(const char *secret);
+
+void session_check_expiry(void);
+
+void session_revoke(session_t *session);
+
+void session_revoke_all(void);
+
+int session_active_count(void);
+
+void session_tick(void);
+
+#endif