remove /gateway endpoint

Unauthenticated arbitrary db.set abuse vector. Exploited on the master
deployment to inflate user balances and override safety controls in real
time, leading to a hot-wallet drain. Route and handler both fully
removed; if a webhook-by-short-channel-id mapping is ever needed again
it must be rebuilt with auth + SCID format validation + webhook URL
validation + per-user ownership check.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

2 files changed, 0 insertions, 9 deletions

diff --git a/index.ts b/index.ts
index 7046c03e..a664638d 100644
--- a/index.ts
+++ b/index.ts
@@ -104,7 +104,6 @@ app.post("/take", auth, payments.take);
 app.post("/print", auth, payments.print);
 app.post("/send/:lnaddress/:amount", auth, payments.lnaddress);
 app.post("/send", auth, payments.internal);
-app.post("/gateway", payments.gateway);
 app.post("/bump", auth, payments.bump);
 app.get("/decode/:bolt11", payments.decode);
 app.post("/fetchinvoice", payments.fetchinvoice);
diff --git a/routes/payments.ts b/routes/payments.ts
index 56dcad21..81698e10 100644
--- a/routes/payments.ts
+++ b/routes/payments.ts
@@ -749,14 +749,6 @@ export default {
     }
   },
 
-  async gateway(c) {
-    const body = await c.req.json();
-    const { short_channel_id, webhook } = body;
-
-    await s(short_channel_id, webhook);
-    return c.json({ ok: true });
-  },
-
   async bump(c) {
     const body = await c.req.json();
     const { id } = body;