'rebuilt missing sales and staff pages

docs/modules/website.md

@@ -9,8 +9,8 @@ Public Gameservers.World sales, documentation, and customer-entry website.
 ## Runtime Location
 
 - Canonical public site: `Panel/modules/website/`
-- Billing catalog and order flow: `Panel/modules/billing/`
-- Legacy compatibility site: `Website/`
+- Billing catalog, order flow, cart, checkout, and website staff pages: `Panel/modules/website/`
+- Backup reference only: `backup-website/`
 
 ## Design Rules
 
@@ -35,6 +35,8 @@ The website module centralizes these helpers in `includes/bootstrap.php`:
 
 The website does not include the billing config loader directly. It reads panel or billing DB values safely, uses them only when needed, and avoids public fatal errors tied to missing config files.
 
+The rebuilt sales/billing details are documented in `docs/modules/website_billing_rebuild.md`.
+
 ## Shared Accounts
 
 The website uses the Panel `users` table as the account source of truth. A customer has the same `user_id` on Gameservers.World, the GSP Panel, support, billing, and server orders.
@@ -55,11 +57,13 @@ The old `billing/order.php` route is obsolete in this repository layout and must
 
 `order.php` validates the requested `service_id` server-side against enabled catalog records before allowing the customer to continue. Anonymous visitors can configure slots and location, add the server package to the session cart, and review the cart before login.
 
-Login or registration is required only at checkout. The cart is stored in the website session and remains available through website login session regeneration. Panel registration is currently linked directly until a website-native registration form is restored.
+Login or registration is required only at checkout. The cart is stored in the website session and remains available through website login session regeneration. Website-native registration and password reset pages are available and use the shared Panel user table.
 
 The website owns catalog display, cart storage, order intent, login-return behavior, checkout entry, and customer confirmation. The Panel owns final provisioning, server assignment to the shared `user_id`, game-home creation, agent handoff, and provisioning state. Public browser requests must not call private provisioning methods directly.
 
-Checkout/payment handlers are not present in this repository checkout. Until the active payment runtime is connected, `cart.php` preserves the validated cart and shows a friendly checkout-unavailable message instead of pretending payment or provisioning is available.
+Checkout creates due invoices and pending-payment orders after login. PayPal order creation and capture run server-side through website API endpoints, and verified PayPal webhook events are deduplicated before being applied.
+
+Paid orders appear in the website provisioning queue. The queue is the handoff point for Panel-side server creation; provisioning must remain idempotent and must not run before payment or approval.
 
 ## Navigation
 
@@ -67,9 +71,9 @@ Website footer account links are state-aware:
 
 - logged out: `Account Login`, `Order a Server`, `Control Panel`
 - logged in: `My Account`, `Order a Server`, `Control Panel`, `My Servers`, `Log Out`
-- staff-only links appear only for Panel admin users and still rely on Panel authorization server-side
+- staff-only links appear only for Panel admin users and still enforce website staff authorization server-side
 
-The website main navigation also includes visible `Login`, `Create Account`, and `Cart` entries when appropriate. Control Panel, My Servers, and staff administration links point directly to the configured Panel domain. The Panel dashboard `Order Another Server` link points directly to the website catalog.
+The website main navigation also includes visible `Login`, `Create Account`, and `Cart` entries when appropriate. Control Panel links point directly to the configured Panel domain. `My Servers` opens a website customer page that summarizes website orders and links to the Panel for live server controls. Staff Dashboard opens the website sales/billing staff area, not Panel activity logging.
 
 ## Deployment
 
@@ -92,9 +96,17 @@ Recommended:
 - `locations.php`
 - `support.php`
 - `login.php`
+- `register.php`
+- `forgot_password.php`
+- `reset_password.php`
 - `account.php`
+- `orders.php`
+- `invoices.php`
+- `my_servers.php`
 - `order.php`
 - `cart.php`
+- `checkout.php`
+- `staff.php`
 - `sso.php`
 
 ## Pricing and Platform Reference