GPay.One / AstroPay - same-folder PHP integration
===============================================
Created for your supplied mysqli table and frontend PHP signatures.

UPLOAD LOCATION
  Place all .php files and .htaccess in the SAME existing /pay/ folder.
  Keep your original database connection file at ../serive/samparka.php.
  No separate SQL file, new table or cron is included.

TWO REQUIRED PORTAL VALUES (CANNOT BE FILLED FROM CHAT)
  Open AP_Config.php and replace:
    PASTE_API_KEY_FROM_MERCHANT_PORTAL
    PASTE_API_SECRET_FROM_MERCHANT_PORTAL
  Get these *API credentials*, NOT the merchant login password, in https://mch.gpay.one/.
  Merchant account identifier was set to zamankhan (display only).

SERVER SETTINGS
  1. Change the merchant PORTAL login password immediately.
  2. Whitelist the actual outgoing IP of the PHP hosting server in the portal.
  3. In AP_Config.php, you may set site_url to https://YOUR-PAY-DOMAIN
     to ensure the callback URL uses the correct domain. With site_url
     empty, PHP SERVER_NAME is used (not user-supplied HTTP_HOST).
  4. Callback URL should be:
       https://YOUR-PAY-DOMAIN/pay/AP_Webhook.php
     If the files are in a different directory, use that directory.
     Permit provider POST callbacks through firewalls/WAF/Cloudflare.
  5. Confirm the PHP server has mysqli, mysqlnd, and curl extensions;
     valid CA SSL trust store; and HTTPS.
  6. Transaction-safe wallet changes require thevani and shonu_kaichila
     to be InnoDB. Check storage engines in phpMyAdmin before live payments.

USE
  Your existing frontend opens /pay/wepay?amount=...&uid=...&sign=...
  wepay.php delegates to AP_Init.php, which verifies the existing frontend
  signature, inserts a pending row, creates gateway payin, and redirects to
  provider-hosted checkout. AP_Init.php may also be called with the SAME signed
  query parameters. Do not open it directly with missing parameters.

  AP_Webhook.php handles ONLY verified POST signatures; success status 10
  performs a transactional, idempotent wallet credit; failure status 9 marks
  pending rows failed. Subsequent callbacks for the same success cannot credit
  twice. No manual UTR is needed for AstroPay checkout.

  adddeposit.php remains available only for the site's legacy/manual UTR
  flow. It creates *pending* requests and never directly credits balance.

STATUS / ERRORS
  0 = pending, 1 = paid, 2 = failed in thevani.sthiti (per supplied code).
  Provider's successful payin create response is expected to include:
    code = 1000, data.pay_url, optional data.order_id
  The webhook signature, as supplied in your old AP_Webhook.php, is MD5-upper
  over alphabetically sorted nonempty orderId,amount,commission,status,utr
  joined as key=value& followed by secret=<secretKey>.

VERIFICATION LIMITATION
  The protected ShowDoc link was not readable from this environment. The
  endpoint, request fields, success statuses and signature contract are based
  ONLY on your uploaded AP_Init.php and AP_Webhook.php. Reconfirm these details
  using the actual password-protected API documentation and a test transaction.
  Live API behavior, merchant access, server IP, callback reachability, schema,
  and end-to-end money movement have NOT been verified here.

SECURITY NOTES
  Do not paste API secrets into public chats or frontend JS.
  Keep .htaccess, never enable public directory listing, and make a backup of
  original files before overwriting them. If .htaccess is ignored by the web
  server, deny HTTP access to AP_Config.php and AP_Common.php at server config.
  The existing frontend SHA256 account-data signature is kept for compatibility;
  it is NOT a secret-key HMAC. For stronger anti-abuse, upgrade the frontend
  recharge-signing endpoint to an authenticated server-side HMAC/session check.
