ELITE TILL · DEPLOYMENT
=======================
Recommended host: till.mall.co.ke
Application path: /home/mallcoke/till_app
Public document root: /home/mallcoke/till_app/public

1. Create a new MySQL/MariaDB database, e.g. mallcoke_till, and a least-privilege DB user.
2. Import database/001_elite_till.sql.
3. Copy config/config.local.php.example -> config/config.local.php and enter DB details.
4. Generate encryption key:
   php -r "echo 'base64:'.base64_encode(random_bytes(32)).PHP_EOL;"
   Put the result in config/config.local.php. NEVER change it after encrypted phone records exist without a migration.
5. Create first admin:
   php bin/create_admin.php admin@example.com "Elite Till Admin" "A-strong-password-here"
6. In cPanel create subdomain till.mall.co.ke pointing exactly to:
   /home/mallcoke/till_app/public
7. Enable AutoSSL/HTTPS. PWA installation and payment callbacks require HTTPS.
8. Log in at https://till.mall.co.ke/login/ and create the first merchant.
9. Configure M-PESA in config/config.local.php. Start with sandbox if appropriate. Generate callback_token with:
   php -r "echo bin2hex(random_bytes(24)).PHP_EOL;"
10. Register/allow these HTTPS callbacks in your provider configuration:
    https://till.mall.co.ke/callbacks/mpesa/stk/
    https://till.mall.co.ke/callbacks/mpesa/b2c/
    https://till.mall.co.ke/callbacks/mpesa/b2c-timeout/
11. Set mpesa.enabled=true only after STK credentials are correct.
12. Keep mpesa.b2c_enabled=false until the settlement model is authorised and B2C credentials are correct.
13. Test: merchant login -> M-PESA sale -> callback -> paid ledger -> dashboard -> PWA install.

No URL rewriting is required; all application routes are physical directories.