Phase 2 WIP: token decode works, TLS checkstate succeeds (crashes after response)

- cashu.c: dynamic json_buf sizing (was 2048 stack, now heap based on token length)
- cashu.c: strip trailing newline/CR from token input (cashu CLI appends 'Balance: 0 sat')
- cashu.c: esp_crt_bundle_attach for HTTPS to mint API
- cashu.c: esp_http_client_open/write/fetch_headers/read pattern for HTTPS POST
- cashu.c: remove debug b64url_decode logging
- tollgate_api.c: loop httpd_req_recv for full body (was single call, missed TCP segments)
- tollgate_api.c: stack_size=32768 for TLS in httpd handler
- config.c: fix default mint URL from nofee.testnut to testnut.cashu.space
- CMakeLists.txt: add esp-tls dependency for cert bundle
- CHECKLIST.md: updated with infrastructure status and TDD plan

Known issue: device reboots after checkstate returns 966 bytes with status=200.
Crash likely in post-response processing (JSON parse or session create).

1 files changed, 15 insertions, 10 deletions

diff --git a/main/tollgate_api.c b/main/tollgate_api.c
index b2ad647..2af04bc 100644
--- a/main/tollgate_api.c
+++ b/main/tollgate_api.c
@@ -162,17 +162,22 @@ static esp_err_t api_post_payment(httpd_req_t *req)
         cJSON_Delete(notice);
         return ESP_OK;
     }
-    int received = httpd_req_recv(req, body, content_len);
-    if (received <= 0) {
-        free(body);
-        httpd_resp_set_status(req, "400 Bad Request");
-        httpd_resp_set_type(req, "text/plain");
-        httpd_resp_send(req, "bad request", 11);
-        return ESP_OK;
+    int received = 0;
+    int total = 0;
+    while (total < content_len) {
+        received = httpd_req_recv(req, body + total, content_len - total);
+        if (received <= 0) {
+            free(body);
+            httpd_resp_set_status(req, "400 Bad Request");
+            httpd_resp_set_type(req, "text/plain");
+            httpd_resp_send(req, "bad request", 11);
+            return ESP_OK;
+        }
+        total += received;
     }
-    body[received] = '\0';
+    body[total] = '\0';
 
-    ESP_LOGI(TAG, "Payment received: %d bytes", received);
+    ESP_LOGI(TAG, "Payment received: %d bytes", total);
 
     cashu_token_t token;
     esp_err_t err = cashu_decode_token(body, &token);
@@ -330,7 +335,7 @@ esp_err_t tollgate_api_start(void)
     config.server_port = 2121;
     config.ctrl_port = 32769;
     config.max_uri_handlers = 10;
-    config.stack_size = 16384;
+    config.stack_size = 32768;
 
     esp_err_t ret = httpd_start(&s_api_server, &config);
     if (ret != ESP_OK) {