Root README.md was frontend-only and didn't mention the backend at all.
server/README.md was stale relative to the endpoint/security changes in this
branch (missing POST /api/payment-links, the sanitized order_id behavior,
rate limiting, CORS, log retention, state persistence, admin auth) and linked
to a temp/README.md that no longer exists. Both now point to /docs, /openapi.json,
and the Postman collection as the source of truth for the API surface.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
GoPay: spinner QRIS dalam frame, hilangkan QR dummy saat menunggu, hapus tombol Buat QR, sanitasi URL actions. CStore: panel pilihan toko di Step 2, auto-generate kode dengan guard StrictMode, perbaiki busy agar tidak nyangkut setelah respons 201. Checkout: jangan auto-advance untuk CStore, oper defaultStore sesuai pilihan. BankTransfer: stabilisasi in-flight promise untuk VA (sebelumnya).
Tengku Achmad
CIFO Dev