QUANTUM PAY — FULL PROJECT API KEY UPDATE
========================================

This is the complete Quantum Pay website project, not a standalone patch.
It preserves the existing website pages/assets and includes updates to API authentication,
merchant mailbox schema installation, and order-status ownership checks.

CHANGES
- API key accepted through X-API-Key (recommended) and Authorization: Bearer headers.
- Hash verification uses SHA-256, matching keys.php generation.
- Clear JSON errors for missing/invalid/revoked keys, disabled API and inactive subscription.
- Merchant UPI is read from enabled merchant_mailboxes first, then legacy users.upi_id.
- Order status is scoped to the authenticated merchant's user_id, preventing cross-merchant lookups.
- install.php creates merchant_mailboxes on fresh installs and upgrades.
- API docs describe the supported auth headers and the one base URL.

DEPLOY SAFELY
1. Back up the current website files and database first.
2. Upload the contents of this ZIP to the same website document root, preserving folders.
3. In config.php, keep your existing real database credentials; do not replace them with sample values.
4. Open install.php while signed in / with database access and run Install / Upgrade Database.
   It is designed to add missing tables without dropping existing data.
5. After the upgrade, remove install.php from public hosting.
6. In Quantum Pay, confirm merchant status is active, subscription_until is in the future,
   merchant Gmail/UPI settings are saved and enabled, then create a NEW API key and copy the
   complete key once. A key prefix shown in the table is not the complete key.
7. Use exactly one base URL: https://fampay.starspacemovie.xyz
   Create order endpoint: https://fampay.starspacemovie.xyz/api/create_order.php
   Status endpoint: https://fampay.starspacemovie.xyz/api/order_status.php?order_id=YOUR_ORDER_ID
8. Send X-API-Key: YOUR_FULL_API_KEY. Do not add /api twice and do not expose keys in browser JS.

EXAMPLE CREATE ORDER BODY
{
  "amount": 25.00,
  "order_id": "TEST-10001",
  "customer_name": "Test Customer",
  "customer_email": "customer@example.com",
  "return_url": "https://example.com/payment-return"
}

EXPECTED ERRORS
- 401 missing_api_key: no supported API key header/query value was sent.
- 401 invalid_api_key: key is incorrect/revoked, or account inactive.
- 402 subscription_inactive: merchant subscription missing/expired.
- 422 merchant_upi_not_configured: save receiving UPI in Merchant Gmail settings.
- 500 api_auth_database_error: database upgrade or schema/DB permissions need review.

IMPORTANT
PHP syntax and archive integrity are checked locally. This package has not been tested against
live hosting or your production database, so take a backup and test with a small amount first.
Do not send anyone your full API key, database password, Gmail app password, or bot token.
