MoonPay card on-ramp for crypto-new members (zero custody)

- GET /api/public/moonpay-url: returns a MoonPay checkout link for POL on
  Polygon (pol_polygon). With partner keys in config (moonpayPublicKey/
  moonpaySecretKey, now PATCHable), the URL is HMAC-signed and prefilled
  with the member's own wallet address + shortfall amount; without keys it
  falls back to MoonPay's generic buy page. MoonPay is merchant of record -
  the site never touches funds.
- Join page: when the connected wallet can't cover the Premium entry, a
  funding box appears with the exact shortfall, a buy button (new tab), and
  a refresh-balance button.
- Training page: "buy POL with a card" callout after the funding video with
  the three things to get right (POL, Polygon network, own address).
- Start page: one-line card-buy pointer under the sponsor card.
- Chatbot canned answer + AI system prompt updated (funding guidance).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

public/join-now.js

@@ -57,7 +57,26 @@
     }catch(e){ $('sponsorLine').textContent='Could not load the current sponsor — please refresh.'; }
   }
 
-  async function refreshBalance(){ try{ var b=await req('eth_getBalance',[account,'latest']); $('bal').textContent=polStr(BigInt(b))+' POL'; }catch(e){} }
+  var lastBal=null;
+  async function refreshBalance(){ try{ var b=await req('eth_getBalance',[account,'latest']); lastBal=BigInt(b); $('bal').textContent=polStr(lastBal)+' POL'; updateFundBox(); }catch(e){} }
+
+  // Card on-ramp: shown only when the connected wallet can't cover the entry.
+  function updateFundBox(){
+    var box=$('fundBox'); if(!box||!costs||lastBal===null) return;
+    var need=regValue();
+    if(lastBal>=need){ box.style.display='none'; return; }
+    var shortPol=Math.max(62,Math.ceil(Number(need-lastBal)/1e18)+5);
+    $('fundMsg').textContent='This wallet holds '+polStr(lastBal)+' POL; the Premium entry is '+polStr(need)+' POL plus a little gas. You can buy the remaining ~'+shortPol+' POL with a debit/credit card, Apple Pay, or Google Pay — delivered straight to this wallet.';
+    box.dataset.pol=shortPol;
+    box.style.display='block';
+  }
+  async function openMoonpay(){
+    try{
+      var box=$('fundBox');
+      var r=await (await fetch('/api/public/moonpay-url?address='+encodeURIComponent(account||'')+'&pol='+encodeURIComponent((box&&box.dataset.pol)||''))).json();
+      if(r&&r.url){ window.open(r.url,'_blank','noopener'); log(r.signed?'MoonPay opened in a new tab with your wallet address pre-filled — complete the purchase there, then come back and refresh your balance.':'MoonPay opened in a new tab. Choose POL on the Polygon network and paste YOUR wallet address ('+account+') as the destination, then come back and refresh your balance.','ok'); }
+    }catch(e){ log('Could not open MoonPay: '+(e.message||e),'err'); }
+  }
 
   async function connect(){
     try{
@@ -133,5 +152,7 @@
     loadSponsor();
     $('connectBtn').addEventListener('click',connect);
     $('joinBtn').addEventListener('click',doJoin);
+    var fb=$('fundBtn'); if(fb)fb.addEventListener('click',openMoonpay);
+    var fr=$('fundRefresh'); if(fr)fr.addEventListener('click',function(){ log('Checking your balance…'); refreshBalance(); });
   });
 })();