feat: harden backend security with HMAC verification, SSL validation, and documentation updates while removing legacy scripts.

backend/core/Auth/JwtService.php

@@ -247,9 +247,26 @@ class JwtService
             $nonce     = $_SERVER['HTTP_X_NONCE'] ?? '';
             $body      = file_get_contents('php://input') ?: '';
 
+            // Replay protection: مُفعّلة فقط عند العملاء الذين يرسلون
+            // Timestamp + Nonce فعلياً (بعض تدفقات الـ wallet القديمة لا ترسلهما بعد)
+            if ($timestamp !== '' && $nonce !== '') {
+                if (abs(time() - (int)$timestamp) > 300) {
+                    error_log("[SECURITY] HMAC timestamp expired | User: $userId | TS: '$timestamp'");
+                    self::abort(403, 'Request expired');
+                }
+                if ($this->redis) {
+                    $nonceKey = "hmac_nonce:{$userId}:{$nonce}";
+                    if ($this->redis->exists($nonceKey)) {
+                        error_log("[SECURITY] HMAC nonce replay detected | User: $userId | Nonce: $nonce");
+                        self::abort(403, 'Replay detected');
+                    }
+                    $this->redis->setex($nonceKey, 300, '1');
+                }
+            }
+
             // اشتقاق مفتاح الـ HMAC الخاص بهذا المستخدم
             $userSecret = hash_hmac('sha256', (string)$userId, $this->hmacSecret);
-            
+
             // المعادلة الموحدة: Body + Timestamp + Nonce
             $payloadToSign = $body . $timestamp . $nonce;
             $expectedHmac  = hash_hmac('sha256', $payloadToSign, $userSecret);