Phase 2 WIP: Cashu payment endpoints, session tracking, updated checklist

- Add cashu.c/h: Cashu token decode (cashuA/base64url), proof state check via mint API, allotment calculator
- Add session.c/h: time-based session management with allotment/expiry, spent secret tracking
- Add tollgate_api.c/h: HTTP server on :2121 with GET / (kind=10021 discovery), POST / (payment processing), /usage, /whoami
- Update captive portal HTML: replace Grant Free Access with Cashu token paste form + Pay & Connect button
- Update tollgate_main.c: wire in session manager, TollGate API, 1s session tick loop
- Add tests/phase2.mjs: Phase 2 test suite (discovery, invalid token, wrong mint, valid payment)
- Update CHECKLIST.md: reflect Phase 1 complete, Phase 2 in progress with known bugs

Known issues (not yet flashed):
- Stack overflow crash in httpd POST handler (need stack_size=16384 + heap allocations)
- cashu_decode_token uses 2KB stack buffer (needs heap alloc)
- Mint URL should be testnut.cashu.space (nofee.testnut has API compat issues)

1 files changed, 10 insertions, 0 deletions

diff --git a/main/tollgate_api.h b/main/tollgate_api.h
new file mode 100644
index 0000000..23e0d75
--- /dev/null
+++ b/main/tollgate_api.h
@@ -0,0 +1,10 @@
+#ifndef TOLLGATE_API_H
+#define TOLLGATE_API_H
+
+#include "esp_err.h"
+#include "esp_http_server.h"
+
+esp_err_t tollgate_api_start(void);
+void tollgate_api_stop(void);
+
+#endif