Config-driven wallet-connect notice (for the Blockaid false-positive window)

New shared wallet-notice.js on join-now, my, training: if config.walletNotice
is set, shows an admin-authored heads-up right above every connect/unlock
button; empty string hides it everywhere (one PATCH, no deploy). Placed at the
friction point only, not a sitewide banner, so unaffected wallets/Mini App
users are not told about a warning they will never see.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

public/my.html

@@ -31,4 +31,4 @@
 </section>
 </main>
 <footer class="wrap disclaimer">All figures are read live from the RM Circle smart contract on Polygon and are historical facts, not a promise of future results. Participation involves cryptocurrency and smart-contract risk. Never use funds you cannot afford to lose.<div class="footer-links"><a href="/">Home</a><a href="/contract">Contract Security</a><a href="/disclaimer">Disclaimers</a><a href="/tools">Promo Tools</a></div></footer>
-<script src="/track.js"></script><script src="/qrlib.js"></script><script src="/rmc-wallet.js"></script><script src="/my.js"></script><script src="/payouts.js" defer></script><script src="/chat.js" defer></script><script src="/translate.js" defer></script><script src="/tg-app.js" defer></script></body></html>
+<script src="/track.js"></script><script src="/qrlib.js"></script><script src="/rmc-wallet.js"></script><script src="/my.js"></script><script src="/payouts.js" defer></script><script src="/chat.js" defer></script><script src="/translate.js" defer></script><script src="/tg-app.js" defer></script><script src="/wallet-notice.js" defer></script></body></html>

public/training.html

@@ -87,4 +87,4 @@
 </div></section>
 </main>
 <footer class="wrap disclaimer">This is an independent RM Circle Team Build training resource. Always confirm transaction details in your wallet before signing. Never disclose your Secret Recovery Phrase.<div class="footer-links"><a href="/">Strategy</a><a href="/start">Getting Started</a><a href="/contract">Contract Security</a><a href="/admin">Team Admin</a><a href="/disclaimer">Disclaimers</a><a href="/how-pay-works">How You Get Paid</a><a href="/tools">Promo Tools</a></div></footer>
-<script src="/track.js"></script><script src="/rmc-wallet.js"></script><script src="/training.js"></script><script src="/chat.js" defer></script><script src="/translate.js" defer></script><script src="/tg-app.js" defer></script><script src="/nav-dash.js" defer></script></body></html>
+<script src="/track.js"></script><script src="/rmc-wallet.js"></script><script src="/training.js"></script><script src="/wallet-notice.js" defer></script><script src="/chat.js" defer></script><script src="/translate.js" defer></script><script src="/tg-app.js" defer></script><script src="/nav-dash.js" defer></script></body></html>

public/wallet-notice.js

@@ -0,0 +1,22 @@
+// Temporary, admin-controlled heads-up shown right above any wallet-connect
+// button while a scanner false-positive is being cleared. Driven by
+// config.walletNotice (admin PATCH): non-empty string = show it, ""/unset =
+// nothing renders. One config flip removes it everywhere, no deploy.
+(function () {
+  'use strict';
+  fetch('/api/public/config').then(function (r) { return r.json(); }).then(function (c) {
+    var msg = (c && c.walletNotice || '').trim();
+    if (!msg) return;
+    var btns = [].slice.call(document.querySelectorAll('button, a.btn'));
+    var targets = btns.filter(function (b) { return /connect|unlock/i.test(b.textContent || ''); });
+    if (!targets.length) return;
+    targets.forEach(function (btn) {
+      if (btn.dataset.wnDone) return; btn.dataset.wnDone = '1';
+      var n = document.createElement('div');
+      n.className = 'callout';
+      n.style.cssText = 'margin:0 0 12px;font-size:13px;line-height:1.5;border-color:rgba(243,190,67,.5)';
+      n.innerHTML = 'ℹ️ ' + msg; // admin-authored, same trust level as other config-injected copy
+      btn.parentNode.insertBefore(n, btn);
+    });
+  }).catch(function () {});
+})();