WHATSAPP BOT V20 — MANUAL NAYAPAY VERIFICATION
=============================================

ADMIN URL
  https://bot.shoaibsubscription.pk/adminpanel/nayapay_topups.php
  Click Review / Verify next to pending payment.

FEATURES
  - Responsive orange/white NayaPay Verification page.
  - Private screenshot preview (accessible to signed-in admins only).
  - OCR: detected screenshot sender and amount (when readable).
  - Actual received amount, bank sender and unique reference can be entered by admin.
  - Manually Verify & Credit ONLY after checking the real NayaPay transaction.
  - Credit Bill: inserts payment, customer ledger entry, reduces due; does NOT add wallet.
  - Wallet Top-up: credits wallet and records wallet transaction/payment.
  - Already Recorded / Close: use when the payment was settled separately; no double credit.
  - Reject: closes pending request without updating wallet or ledger.
  - Both methods record admin ID and action in nayapay_manual_reviews.
  - Duplicate paid transaction references and paid screenshot hashes are rejected.
  - Auto-verification refuses cancelled, rejected, and already-closed payment requests.

INSTALLATION
  1. BACK UP current website files and MySQL database first.
  2. Upload Changed Files ZIP and EXTRACT within existing website parent directory,
     preserving the bot.shoaibsubscription.pk/ folder structure and overwriting matching PHP files.
  3. On first visit to NayaPay Verification, the audit table will auto-create if the
     database user has CREATE TABLE permission. Otherwise import:
     database/V20_MANUAL_NAYAPAY_VERIFICATION.sql into existing database using phpMyAdmin.
  4. In Admin Panel, open NayaPay Verification > Pending & Review > Review / Verify.
  5. Confirm actual payment in your own NayaPay account BEFORE approving.
  6. Enter ACTUAL received amount, verified sender name, UNIQUE transaction/reference ID.
  7. Tick confirmation, click Manually Verify & Credit.
  8. For a payment you ALREADY recorded via Customer Ledger, click Already Recorded · Close instead.
  9. Test with a small real transaction and confirm Wallet or Customer Ledger updates once.

RESTRICTIONS AND WARNINGS
  - OCR is not proof; screenshots can be forged. Only manual verification against
    YOUR genuine NayaPay transaction is accepted for manual credit.
  - If OCR/Tesseract is missing, the screenshot preview remains available and the
    admin may type real sender/amount from bank transaction history.
  - Approval amount must be positive and at most the customer's requested amount;
    for credit bills also cannot exceed current due.
  - A missing screenshot or already completed request cannot be manually credited.
  - If private payment was recorded without a reference in Customer Ledger earlier,
    the admin MUST use Already Recorded · Close; automatic cross-matching is impossible.
  - Do not import old recovery.sql again. This upgrade does not need historical data resets.
  - User's original full ZIP contains private environment secrets/Gmail OAuth tokens.
    Keep full ZIP PRIVATE and rotate exposed credentials if needed.
  - PHP lint / static checks do not replace a live cPanel+MySQL/NayaPay test.
