waha: QR pairing in dashboard, whatsapp/qr API, settings overhaul

- /api/whatsapp/qr: GET returns session status + QR image, POST starts/restarts session
- Settings page: WhatsApp panel shows QR code for pairing, connected status with phone info
- WAHA session started with webhook pointing to /api/whatsapp/webhook
- WAHA_API_URL updated to external https://waha.quikcue.com (cross-stack DNS doesn't work)
- Auto-polls every 5 seconds during QR scan state
- Shows connected state with phone number, push name, feature summary

pledge-now-pay-later/src/app/api/whatsapp/qr/route.ts

@@ -0,0 +1,123 @@
+import { NextResponse } from "next/server"
+
+const WAHA_URL = process.env.WAHA_API_URL || "https://waha.quikcue.com"
+const WAHA_KEY = process.env.WAHA_API_KEY || "qc-waha-api-7Fp3nR9xYm2K"
+const WAHA_SESSION = process.env.WAHA_SESSION || "default"
+
+/**
+ * GET /api/whatsapp/qr
+ * Returns the WAHA QR code screenshot as PNG for WhatsApp pairing.
+ * Also returns session status.
+ */
+export async function GET() {
+  try {
+    // First check session status
+    const sessRes = await fetch(`${WAHA_URL}/api/sessions`, {
+      headers: { "X-Api-Key": WAHA_KEY },
+      signal: AbortSignal.timeout(5000),
+    })
+    const sessions = await sessRes.json()
+
+    const session = Array.isArray(sessions)
+      ? sessions.find((s: { name: string }) => s.name === WAHA_SESSION)
+      : null
+
+    if (!session) {
+      return NextResponse.json({
+        status: "NO_SESSION",
+        message: "No WAHA session exists. Start one first.",
+      })
+    }
+
+    if (session.status === "WORKING") {
+      const me = session.me || {}
+      return NextResponse.json({
+        status: "CONNECTED",
+        phone: me.id?.replace("@c.us", "") || "unknown",
+        pushName: me.pushname || "",
+      })
+    }
+
+    if (session.status === "SCAN_QR_CODE") {
+      // Get screenshot
+      const qrRes = await fetch(`${WAHA_URL}/api/screenshot?session=${WAHA_SESSION}`, {
+        headers: { "X-Api-Key": WAHA_KEY },
+        signal: AbortSignal.timeout(10000),
+      })
+
+      if (!qrRes.ok) {
+        return NextResponse.json({ status: "SCAN_QR_CODE", error: "Failed to get QR" })
+      }
+
+      const buffer = await qrRes.arrayBuffer()
+      const base64 = Buffer.from(buffer).toString("base64")
+
+      return NextResponse.json({
+        status: "SCAN_QR_CODE",
+        qrImage: `data:image/png;base64,${base64}`,
+        message: "Scan this QR code with WhatsApp on your phone",
+      })
+    }
+
+    return NextResponse.json({
+      status: session.status,
+      message: `Session is ${session.status}`,
+    })
+  } catch (error) {
+    console.error("WhatsApp QR error:", error)
+    return NextResponse.json({ status: "ERROR", error: String(error) })
+  }
+}
+
+/**
+ * POST /api/whatsapp/qr - Start or restart a session
+ */
+export async function POST() {
+  try {
+    // Check if session exists
+    const sessRes = await fetch(`${WAHA_URL}/api/sessions`, {
+      headers: { "X-Api-Key": WAHA_KEY },
+      signal: AbortSignal.timeout(5000),
+    })
+    const sessions = await sessRes.json()
+    const existing = Array.isArray(sessions)
+      ? sessions.find((s: { name: string }) => s.name === WAHA_SESSION)
+      : null
+
+    if (existing) {
+      // Stop and restart
+      await fetch(`${WAHA_URL}/api/sessions/stop`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", "X-Api-Key": WAHA_KEY },
+        body: JSON.stringify({ name: WAHA_SESSION }),
+        signal: AbortSignal.timeout(10000),
+      })
+      // Small delay
+      await new Promise(r => setTimeout(r, 2000))
+    }
+
+    // Start session with webhook
+    const startRes = await fetch(`${WAHA_URL}/api/sessions/start`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", "X-Api-Key": WAHA_KEY },
+      body: JSON.stringify({
+        name: WAHA_SESSION,
+        config: {
+          webhooks: [
+            {
+              url: `${process.env.BASE_URL || "https://pledge.quikcue.com"}/api/whatsapp/webhook`,
+              events: ["message"],
+            },
+          ],
+        },
+      }),
+      signal: AbortSignal.timeout(15000),
+    })
+
+    const result = await startRes.json()
+    return NextResponse.json({ success: true, status: result.status || "STARTING" })
+  } catch (error) {
+    console.error("WhatsApp session start error:", error)
+    return NextResponse.json({ success: false, error: String(error) })
+  }
+}