Config-driven wallet-connect notice (for the Blockaid false-positive window)

New shared wallet-notice.js on join-now, my, training: if config.walletNotice
is set, shows an admin-authored heads-up right above every connect/unlock
button; empty string hides it everywhere (one PATCH, no deploy). Placed at the
friction point only, not a sitewide banner, so unaffected wallets/Mini App
users are not told about a warning they will never see.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

private/join-now.html

@@ -71,4 +71,4 @@
   <p class="micro" style="text-align:center">No income is guaranteed. Cryptocurrency and smart-contract participation carry risk. Only use funds you can afford to lose.</p>
 </main>
 <footer class="wrap disclaimer">All figures are read live from the RM Circle smart contract on Polygon. Not an earnings guarantee or investment advice. Participation carries risk of loss.<div class="footer-links"><a href="/">Home</a><a href="/training">Training</a><a href="/how-pay-works">How You Get Paid</a><a href="/contract">Contract Security</a><a href="/disclaimer">Disclaimers</a></div></footer>
-<script src="/track.js"></script><script src="/tg-app.js"></script><script src="/rmc-wallet.js"></script><script src="/join-now.js"></script><script src="/translate.js" defer></script></body></html>
+<script src="/track.js"></script><script src="/tg-app.js"></script><script src="/rmc-wallet.js"></script><script src="/join-now.js"></script><script src="/wallet-notice.js" defer></script><script src="/translate.js" defer></script></body></html>

public/my.html

@@ -31,4 +31,4 @@
 </section>
 </main>
 <footer class="wrap disclaimer">All figures are read live from the RM Circle smart contract on Polygon and are historical facts, not a promise of future results. Participation involves cryptocurrency and smart-contract risk. Never use funds you cannot afford to lose.<div class="footer-links"><a href="/">Home</a><a href="/contract">Contract Security</a><a href="/disclaimer">Disclaimers</a><a href="/tools">Promo Tools</a></div></footer>
-<script src="/track.js"></script><script src="/qrlib.js"></script><script src="/rmc-wallet.js"></script><script src="/my.js"></script><script src="/payouts.js" defer></script><script src="/chat.js" defer></script><script src="/translate.js" defer></script><script src="/tg-app.js" defer></script></body></html>
+<script src="/track.js"></script><script src="/qrlib.js"></script><script src="/rmc-wallet.js"></script><script src="/my.js"></script><script src="/payouts.js" defer></script><script src="/chat.js" defer></script><script src="/translate.js" defer></script><script src="/tg-app.js" defer></script><script src="/wallet-notice.js" defer></script></body></html>

public/training.html

@@ -87,4 +87,4 @@
 </div></section>
 </main>
 <footer class="wrap disclaimer">This is an independent RM Circle Team Build training resource. Always confirm transaction details in your wallet before signing. Never disclose your Secret Recovery Phrase.<div class="footer-links"><a href="/">Strategy</a><a href="/start">Getting Started</a><a href="/contract">Contract Security</a><a href="/admin">Team Admin</a><a href="/disclaimer">Disclaimers</a><a href="/how-pay-works">How You Get Paid</a><a href="/tools">Promo Tools</a></div></footer>
-<script src="/track.js"></script><script src="/rmc-wallet.js"></script><script src="/training.js"></script><script src="/chat.js" defer></script><script src="/translate.js" defer></script><script src="/tg-app.js" defer></script><script src="/nav-dash.js" defer></script></body></html>
+<script src="/track.js"></script><script src="/rmc-wallet.js"></script><script src="/training.js"></script><script src="/wallet-notice.js" defer></script><script src="/chat.js" defer></script><script src="/translate.js" defer></script><script src="/tg-app.js" defer></script><script src="/nav-dash.js" defer></script></body></html>

public/wallet-notice.js

@@ -0,0 +1,22 @@
+// Temporary, admin-controlled heads-up shown right above any wallet-connect
+// button while a scanner false-positive is being cleared. Driven by
+// config.walletNotice (admin PATCH): non-empty string = show it, ""/unset =
+// nothing renders. One config flip removes it everywhere, no deploy.
+(function () {
+  'use strict';
+  fetch('/api/public/config').then(function (r) { return r.json(); }).then(function (c) {
+    var msg = (c && c.walletNotice || '').trim();
+    if (!msg) return;
+    var btns = [].slice.call(document.querySelectorAll('button, a.btn'));
+    var targets = btns.filter(function (b) { return /connect|unlock/i.test(b.textContent || ''); });
+    if (!targets.length) return;
+    targets.forEach(function (btn) {
+      if (btn.dataset.wnDone) return; btn.dataset.wnDone = '1';
+      var n = document.createElement('div');
+      n.className = 'callout';
+      n.style.cssText = 'margin:0 0 12px;font-size:13px;line-height:1.5;border-color:rgba(243,190,67,.5)';
+      n.innerHTML = 'ℹ️ ' + msg; // admin-authored, same trust level as other config-injected copy
+      btn.parentNode.insertBefore(n, btn);
+    });
+  }).catch(function () {});
+})();

server.js

@@ -492,7 +492,7 @@ function staticFile(req,res,file,status=200){
 async function handleApi(req,res,pathname){
   if(req.method==='GET'&&pathname==='/health') return json(res,200,{ok:true});
   if(req.method==='GET'&&pathname==='/api/public/config'){
-    const c=getConfig();await getPolUsd().catch(()=>{});return json(res,200,{polUsd:polPrice.usd||0,siteName:c.siteName,programName:c.programName,bridgeHeadline:c.bridgeHeadline,bridgeSubheadline:c.bridgeSubheadline,premiumEntryPol:c.premiumEntryPol,telegramUrl:c.telegramUrl,supportLabel:c.supportLabel,showQueueProgress:c.showQueueProgress});
+    const c=getConfig();await getPolUsd().catch(()=>{});return json(res,200,{polUsd:polPrice.usd||0,siteName:c.siteName,programName:c.programName,bridgeHeadline:c.bridgeHeadline,bridgeSubheadline:c.bridgeSubheadline,premiumEntryPol:c.premiumEntryPol,telegramUrl:c.telegramUrl,supportLabel:c.supportLabel,showQueueProgress:c.showQueueProgress,walletNotice:c.walletNotice||''});
   }
   if(req.method==='GET'&&pathname==='/api/public/member'){
     const ip=String(req.headers['x-forwarded-for']||req.socket.remoteAddress||'').split(',')[0].trim();
@@ -821,7 +821,7 @@ async function handleApi(req,res,pathname){
     const maxOrder=sponsors.reduce((m,s)=>Math.max(m,s.sortOrder||0),0);sponsors.push({id:String(id).trim(),name:String(name).trim(),parentId:String(parentId||'').trim(),directs:0,level,status:sponsors.some(s=>s.status==='active')?'waiting':'active',sortOrder:maxOrder+10,clicks:0,notes:String(notes||'').trim(),email:String(email||'').trim().slice(0,120)});sponsors=normalizeStatuses(sponsors);saveSponsors(sponsors);return json(res,201,{sponsors});
   }
   if(req.method==='PATCH'&&pathname==='/api/admin/config'){
-    const b=await bodyJson(req),cur=getConfig(),next={...cur};for(const k of ['siteName','programName','bridgeHeadline','bridgeSubheadline','premiumEntryPol','dappReferralBaseUrl','telegramUrl','supportLabel','showSponsorName','showQueueProgress','bemobPostbackUrl','telegramBotToken','companionBotToken','miniAppShortName','telegramChatId','telegramTopicId','telegramRecruitTopicId','teamRootId','emailFrom','teamAlertEmail','ownerIds','ownerAlertEmail','orgRootId','ctbOfferPostbackUrl','ctbOfferSecret','recruitCtaUrl','tweetEnabled','tweetCtaUrl','tweetHashtags','blotatoTwitterId','dappFallbackPublic','moonpayPublicKey','moonpaySecretKey','publicRotationMode','publicRotationRootId','rotationExcludeIds'])if(Object.prototype.hasOwnProperty.call(b,k))next[k]=b[k];next.premiumEntryPol=Number(next.premiumEntryPol)||362;next.updatedAt=new Date().toISOString();writeJson(CONFIG_FILE,next);return json(res,200,{config:next});
+    const b=await bodyJson(req),cur=getConfig(),next={...cur};for(const k of ['siteName','programName','bridgeHeadline','bridgeSubheadline','premiumEntryPol','dappReferralBaseUrl','telegramUrl','supportLabel','showSponsorName','showQueueProgress','bemobPostbackUrl','telegramBotToken','companionBotToken','miniAppShortName','telegramChatId','telegramTopicId','telegramRecruitTopicId','teamRootId','emailFrom','teamAlertEmail','ownerIds','ownerAlertEmail','orgRootId','ctbOfferPostbackUrl','ctbOfferSecret','recruitCtaUrl','walletNotice','tweetEnabled','tweetCtaUrl','tweetHashtags','blotatoTwitterId','dappFallbackPublic','moonpayPublicKey','moonpaySecretKey','publicRotationMode','publicRotationRootId','rotationExcludeIds'])if(Object.prototype.hasOwnProperty.call(b,k))next[k]=b[k];next.premiumEntryPol=Number(next.premiumEntryPol)||362;next.updatedAt=new Date().toISOString();writeJson(CONFIG_FILE,next);return json(res,200,{config:next});
   }
   const m=pathname.match(/^\/api\/admin\/sponsors\/([^/]+)(?:\/(increment|activate|qualify|reset|move))?$/);
   if(m){const id=decodeURIComponent(m[1]),action=m[2]||null;let sponsors=getSponsors(),idx=sponsors.findIndex(s=>s.id===id);if(idx<0)return json(res,404,{error:'Sponsor not found.'});