ecash: drop anonymous token storage in favour of a stateless status lookup

POST /cash stored any submitted string under a fresh id with no auth, no
validation and no expiry. Replace it with POST /ecash/status, which checks a
token the client already holds and returns its total, spent amount and mint.
GET /cash/:id/:version stays so previously shared ids keep resolving.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

1 files changed, 1 insertions, 1 deletions

diff --git a/index.ts b/index.ts
index 2c386556..22854661 100644
--- a/index.ts
+++ b/index.ts
@@ -198,7 +198,7 @@ app.post("/shopify/:id", shopify);
 app.get("/bolt12", fixBolt12);
 
 app.get("/cash/:id/:version", ecash.get);
-app.post("/cash", ecash.save);
+app.post("/ecash/status", ecash.status);
 app.post("/claim", auth, ecash.claim);
 app.post("/ecash/:id", ecash.receive);