WHATSAPP BOT V21 — CREDIT BILL / NAYAPAY AUTO-VERIFY FIX
======================================================

SYMPTOM
  A customer sends BILL -> amount -> screenshot, but receives PAYMENT
  VERIFICATION PENDING while normal Wallet TOPUP works.

CODE ISSUES FOUND IN V20
  1. Credit payments applied additional brittle header/receipt label checks
     that Wallet TOPUP did not apply.
  2. Credit payment verification refused to continue when the screenshot
     amount could not be OCR-read, even if verified NayaPay email had it.
  3. CHECK sometimes picked a separate wallet request instead of the pending
     credit-bill screenshot.

FIXES
  - Credit verification accepts Gmail's DKIM, SPF or DMARC authentication
    results when aligned with the genuine nayapay.com sender domain; a
    user-written From header alone is NEVER sufficient.
  - Genuine NayaPay receipt amount may use common labeled formats such as
    Amount Received, Total Amount, Transfer Amount, or Amount (PKR).
  - An unreadable SCREENSHOT AMOUNT no longer blocks credit verification IF
    screenshot SENDER NAME is legible and an authenticated, fresh, unused
    NayaPay Gmail receipt proves the EXACT requested amount and source name.
  - A screenshot amount that IS readable but DIFFERS from requested amount
    is still blocked for manual review (never silently bypassed).
  - The only balance adjustment for a credit-bill payment is a customer
    ledger payment + reduced current_due. The wallet balance is untouched.
  - CHECK prioritizes an existing pending credit payment screenshot.
  - Cron can retry some earlier manual_review bills whose only prior issue
    was missing OCR screenshot amount; other manual_review cases stay manual.
  - Existing V20 admin Review / Verify / Already Recorded functions retained.

INSTALL (V20 -> V21)
  1. BACK UP your current website files and MySQL database.
  2. Upload V21_CHANGED_ONLY.zip in your hosting parent directory and EXTRACT;
     overwrite ONLY the corresponding existing bot.shoaibsubscription.pk files.
  3. There are THREE modified files:
       bot.shoaibsubscription.pk/nayapay_topup.php
       bot.shoaibsubscription.pk/webhook/message_handler.php
       bot.shoaibsubscription.pk/cron/nayapay_verify.php
  4. No new SQL migration, credentials, Gmail OAuth or NayaPay bank details
     are needed for this patch.
  5. Keep the existing verification cron active and Tesseract working.
  6. Test with a NEW SMALL, REAL incoming NayaPay payment:
       Credit customer: BILL -> 200 -> pay actual bank account -> screenshot
       Bot should deduct 200 only AFTER matching verified receipt.
       Example: Rs. 400 due becomes Rs. 200 due.
  7. For OLD pending requests, ask the customer to send CHECK. Some older
     manual_review cases are eligible for cron retry; others require admin
     NayaPay Verification > Review / Verify.

PAYMENT SAFETY
  - A screenshot by itself is NOT proof of money received.
  - The bot requires a fresh authenticated matching NayaPay email receipt.
  - A mismatched source name, mismatched amount, missing Gmail authentication,
    OCR name failure, missing receipt or duplicate transaction remains pending
    or goes to manual review. Do not auto-credit unverified evidence.
  - The admin can manually approve ONLY after confirming that the money
    actually reached their NayaPay account, or use Already Recorded if the
    payment was previously added to the ledger.
  - A transfer to a wrong account or an email not in the configured mailbox
    cannot be auto-verified.

ADMIN REASON / FALLBACK
  https://bot.shoaibsubscription.pk/adminpanel/nayapay_topups.php
  Open the pending credit bill and read "Status / Reason".
  Use Review / Verify if receipt authentic, but automated matching cannot
  prove the transaction. Do not pay twice just to retry verification.

VALIDATION
  - Syntax checked all changed PHP files.
  - Tested parsing of common email labels, matching and spoofed email headers.
  - NOT tested with a real NayaPay transfer or the user's live cPanel/Gmail.
  - Take a backup and test a small new payment on the live system.
