Wallet discovery: detect Phantom (window.phantom.ethereum) + legacy providers[]

Phantom exposes its EVM provider at window.phantom.ethereum and does not always
fire EIP-6963, so the picker never saw it. probeInjected() now folds in Phantom
and any window.ethereum.providers[] entries (deduped by identity + name) for
both pick() and list(). Phantom added to the mobile in-app-browser hint and the
dashboard no-wallet message.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

private/join-now.html

@@ -27,7 +27,7 @@
       <a id="mmDeep" class="btn btn-secondary" style="width:100%;margin-bottom:8px" href="#">🦊 Open in MetaMask</a>
       <a id="twDeep" class="btn btn-secondary" style="width:100%;margin-bottom:10px" href="#">🛡️ Open in Trust Wallet</a>
       <div style="border-top:1px solid var(--line);padding-top:10px">
-        <div style="font-weight:700;font-size:13px;margin-bottom:4px">📲 Using SafePal, Coinbase Wallet, Rabby, or another app?</div>
+        <div style="font-weight:700;font-size:13px;margin-bottom:4px">📲 Using SafePal, Phantom, Coinbase Wallet, Rabby, or another app?</div>
         <p class="micro" style="margin:0">Every wallet app has its own built-in browser — that's how it connects. Open <strong>your wallet app</strong> → find the <strong>Browser</strong> or <strong>DApp</strong> tab (SafePal: the compass/🧭 "DApps" tab at the bottom) → type <strong>rmcircle.team/join/<span id="wbId">…</span></strong> and open it there. Your wallet appears automatically, ready to connect — no matter which wallet you use.</p>
       </div>
       <p class="micro" style="margin:8px 0 0">⚠️ <strong>Trust Wallet bouncing you back here?</strong> Trust's built-in browser is switched off by default. <a href="https://link.trustwallet.com/browser_enable" rel="noopener">Tap here to switch it on</a> (or in Trust: Settings → Preferences → DApp Browser → enable), then tap "Open in Trust Wallet" again.</p>

public/my.js

@@ -317,7 +317,7 @@
     const err=document.getElementById('msgAuthErr');
     try{
       const eth=await window.RMCWallet.pick();
-      if(!eth){err.textContent='No wallet found in this browser. On a phone, open your wallet app (SafePal, MetaMask, Trust, Coinbase…), go to its Browser or DApp tab, and type this page\'s address there — your wallet connects automatically.';return;}
+      if(!eth){err.textContent='No wallet found in this browser. On a phone, open your wallet app (SafePal, Phantom, MetaMask, Trust, Coinbase…), go to its Browser or DApp tab, and type this page\'s address there — your wallet connects automatically.';return;}
       const accs=await eth.request({method:'eth_requestAccounts'});const account=accs[0];
       const ch=await(await fetch('/api/public/msg-challenge',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({address:account})})).json();
       if(!ch.message)throw new Error(ch.error||'Could not start sign-in.');

public/rmc-wallet.js

@@ -15,6 +15,31 @@
   function request(){ try{ window.dispatchEvent(new Event('eip6963:requestProvider')); }catch(e){} }
   request();
 
+  // Some wallets don't fire EIP-6963 in every setup (notably Phantom, whose EVM
+  // provider lives at window.phantom.ethereum), and older multi-wallet setups
+  // expose window.ethereum.providers[]. Fold those in so nobody's wallet is
+  // invisible at Connect. Dedupe by provider identity AND name.
+  function probeInjected(list){
+    function add(provider,name,rdns){
+      if(!provider) return;
+      if(list.some(function(w){return w.provider===provider||(w.info&&w.info.name===name);})) return;
+      list.push({info:{name:name,rdns:rdns||'',uuid:'',icon:''},provider:provider});
+    }
+    try{
+      var eth=window.ethereum;
+      if(eth&&Array.isArray(eth.providers)){
+        eth.providers.forEach(function(p){
+          if(!p)return;
+          var nm=p.isPhantom?'Phantom':p.isMetaMask?'MetaMask':p.isCoinbaseWallet?'Coinbase Wallet':p.isTrust||p.isTrustWallet?'Trust Wallet':p.isRabby?'Rabby':'Injected wallet';
+          add(p,nm);
+        });
+      }
+      if(window.phantom&&window.phantom.ethereum) add(window.phantom.ethereum,'Phantom','app.phantom');
+      if(eth&&eth.isPhantom&&!(window.phantom&&window.phantom.ethereum)) add(eth,'Phantom','app.phantom');
+    }catch(e){}
+    return list;
+  }
+
   function showPicker(list){
     return new Promise(function(resolve){
       var ov=document.createElement('div');
@@ -45,13 +70,13 @@
       return new Promise(function(resolve){
         request();
         setTimeout(function(){
-          var list=found.slice();
+          var list=probeInjected(found.slice());
           if(list.length===0){ resolve(window.ethereum||null); return; }
           if(list.length===1){ resolve(list[0].provider); return; }
           showPicker(list).then(resolve);
-        }, 160);
+        }, 220);
       });
     },
-    list:function(){ return found.slice(); }
+    list:function(){ return probeInjected(found.slice()); }
   };
 })();