NexaPay purge: VYNDR is Stripe-only — remove all NexaPay traces

NexaPay was cross-project contamination (from another venture) — never a real
VYNDR payment path. Purged; Stripe path untouched.

Removed:
- web/src/services/nexapay.ts (createPaymentLink/getTransaction/HMAC verify)
- web/src/app/api/webhook/nexapay/route.ts (the only importer; Next-registered,
  reachable — now gone)
- NexaPay comments in email.ts + checkout/route.ts
- Active NexaPay entries in docs/SYSTEM-MANIFEST.md (route list, NEXAPAY_* env
  table, service row) + stale claim in wiring-data-train.md
- sw.js precache entry for the deleted webhook chunk

Verified: ZERO NexaPay in code (web/src, src, tests). Full suite 3833 green
(count unchanged — nothing depended on it, confirming it was dead). Web build
exit 0. sw.js parses clean. Stripe checkout untouched (Next→Express→Stripe).

FLAGGED FOR KEV (a repo delete cannot close these):
- Coolify env: remove NEXAPAY_API_KEY / NEXAPAY_WEBHOOK_SECRET / NEXAPAY_API_URL
- Revoke the NexaPay API key + webhook secret at NexaPay's dashboard; de-register
  the webhook if an account was ever configured
- DB column user_profiles.nexapay_customer_id is orphaned (no reader/writer) —
  drop via a follow-up migration (migration 011 left as history)

Cross-project check: ZERO Noctem-Supabase refs; VYNDR references only its own
Supabase (zmdnczhtdxcddsxzttub). NexaPay was the sole contamination found.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VsztNChZ7vEvSR61AuMhD1

docs/SYSTEM-MANIFEST.md

@@ -101,7 +101,7 @@ Mounted in `src/app.js`. Auth column meanings:
 These are proxies or thin wrappers; they hit Express via `BACKEND_URL`
 or the Python service via `NEXT_PUBLIC_NBA_SERVICE_URL`.
 
-- `/api/checkout` (POST/GET) — Stripe checkout proxy (Session 8 cutover — was NexaPay)
+- `/api/checkout` (POST/GET) — Stripe checkout proxy
 - `/api/games/[id]` and `/api/games/tonight` — list / detail
 - `/api/games/[id]/props` — props for a game
 - `/api/intelligence/feed` — homepage live signals
@@ -117,7 +117,6 @@ or the Python service via `NEXT_PUBLIC_NBA_SERVICE_URL`.
 - `/api/stats/parlays-graded`, `/api/stats/public` — proxy
 - `/api/user/profile`, `/api/user/scans`, `/api/user/recent-scans`
 - `/api/waitlist` — proxy
-- `/api/webhook/nexapay` — NexaPay webhook (legacy — Stripe cutover Session 8; webhook still listening for any in-flight NexaPay events)
 
 ### Next.js pages (Session 8 additions)
 
@@ -175,9 +174,6 @@ back). Updated this session in Section 1 of Session 7c.
 | `STRIPE_PRICE_DESK_FOUNDER`  | ✓    |
 | `FOUNDER_CODES`              | ✓    |
 | `FOUNDER_CODE_EXPIRY`        | ✓    |
-| `NEXAPAY_API_URL`            | ✓ (added 7c) |
-| `NEXAPAY_API_KEY`            | ✓ (added 7c) |
-| `NEXAPAY_WEBHOOK_SECRET`     | ✓ (added 7c) |
 
 ### Push
 | Var                          | Doc? |
@@ -427,7 +423,6 @@ Source: `grep -rn "cacheSet\|cacheGet\|redis\.set"`.
 | FanDuel/BetMGM/Caesars/PrizePicks/Covers/Rotowire (legacy) | each `*Adapter.js` | none | tunable | UnifiedOddsProvider |
 | Sports-Reference HTML | `scripts/scrape-sports-reference.js` | `REF_HTML_FILE`, `COACH_HTML_FILE` (optional) | 1 req / 5s | scraper |
 | Resend (email) | `web/src/services/email.ts`          | `RESEND_API_KEY`, `RESEND_FROM_EMAIL` | n/a               | transactional email      |
-| NexaPay        | `web/src/services/nexapay.ts`        | `NEXAPAY_*`                           | n/a               | checkout fallback        |
 | PostHog        | `web/src/lib/analytics.ts`           | `NEXT_PUBLIC_POSTHOG_KEY/HOST`        | n/a               | browser analytics        |
 | football-data.org | `footballDataAdapter.js`          | `FOOTBALL_DATA_API_KEY`               | 10/min (8 enforced) | poller-soccer, prefetch (TERTIARY) |
 | api-football.com | `apiFootballAdapter.js`            | `API_FOOTBALL_KEY`                    | 100/day (soft 90) | soccer cascade (PRIMARY, Session 9) |
@@ -703,10 +698,13 @@ The dual-provider divergence flagged in 7h is closed:
    shipped. Express `stripeService.js` updated to point `success_url`
    and `cancel_url` at the new frontend pages via `NEXT_PUBLIC_SITE_URL`
    (the only backend file touched in Session 8).
-4. NexaPay is still wired but no UI calls it. Disposition (remove vs
-   keep as fallback) is a follow-up call — leaving it in place doesn't
-   cost anything and gives the team a fallback if Stripe goes down
-   during the World Cup window.
+4. NexaPay has been PURGED (2026-07-27). VYNDR is Stripe-only — NexaPay was
+   cross-project contamination copied from another venture and never a real
+   VYNDR payment path. Code, route, and env references removed. Provider-side
+   cleanup owed to Kev: remove `NEXAPAY_*` from Coolify env, revoke the NexaPay
+   API key + webhook secret, and de-register the webhook at NexaPay if an
+   account was ever configured. DB column `user_profiles.nexapay_customer_id`
+   is orphaned (no reader/writer) — drop via a follow-up migration.
 
 ---