Add ONION-URLS.md, export script, and tighten README

- ONION-URLS.md: static registry of all 43 hidden services (port, role, app path)
- scripts/export-onion-urls.sh: writes live .onion addresses to onion-urls.txt at runtime
- npm run onions:export shortcut added to package.json
- onion-urls.txt added to .gitignore (runtime artifact, not source)
- README: cohesive rewrite — architecture diagram, operator command table, source-of-truth
  map, BTCPay notes, full site map, common fixes
- BTCPay status route: awaited params destructuring (Next 15 async params)

Made-with: Cursor

ONION-URLS.md

@@ -0,0 +1,107 @@
+# CyberLux — Onion URL Reference
+
+All 43 Tor v3 hidden services. Live `.onion` addresses are generated at runtime by Tor and stored in `/var/lib/tor/<service>/hostname`. This file is a **static registry**; use the commands below to resolve live addresses.
+
+---
+
+## Get Live URLs
+
+```bash
+# Print all live .onion URLs (reads /var/lib/tor/*/hostname)
+bash scripts/list-onion-urls.sh
+# or with sudo if not readable as your user:
+sudo bash scripts/list-onion-urls.sh
+
+# Save live URLs to onion-urls.txt in the repo root
+sudo bash scripts/export-onion-urls.sh
+```
+
+---
+
+## Service Registry
+
+| # | `torDir` | Port | Role | App Path |
+|---|----------|------|------|----------|
+| 1 | `cyberlux` | 8080 | Hub — main storefront | `/` |
+| 2 | `cyberlux_forum` | 8081 | Void Aggregate — forum | `/forum` |
+| 3 | `cyberlux_exchange` | 8082 | Classifieds exchange | `/exchange` |
+| 4 | `cyberlux_wiki` | 8083 | Hidden-wiki layer | `/hidden-wiki` |
+| 5 | `cyberlux_market` | 8084 | Full catalog / market | `/market` |
+| 6 | `cyberlux_barter` | 8085 | Ash Pit barter | `/barter` |
+| 7 | `cyberlux_chatter` | 8086 | Chatter / live feed | `/chatter` |
+| 8 | `cyberlux_search` | 8087 | Void Crawler search | `/search` |
+| 9 | `cyberlux_syndicate` | 8088 | Shell network syndicate | `/syndicate` |
+| 10 | `cyberlux_arb_academy` | 8089 | Arb Academy | `/arb-academy` |
+| 11 | `cyberlux_reviews` | 8090 | Reviews | `/reviews` |
+| 12 | `cyberlux_trust` | 8091 | Trust / reputation layer | `/trust` |
+| 13 | `cyberlux_vault` | 8092 | Vault / secure storage | `/vault` |
+| 14 | `cyberlux_messages` | 8093 | Private messages | `/messages` |
+| 15 | `cyberlux_drop_box` | 8094 | Drop Box | `/drop-box` |
+| 16 | `cyberlux_easter_eggs` | 8095 | Easter Eggs | `/easter-eggs` |
+| 17 | `cyberlux_links` | 8096 | Curated links | `/links` |
+| 18 | `cyberlux_red_room` | 8097 | Red Room | `/red-room` |
+| 19 | `cyberlux_drops` | 8098 | Drops | `/drops` |
+| 20 | `cyberlux_inner_circle` | 8099 | Inner Circle | `/inner-circle` |
+| 21 | `cyberlux_comparison` | 8100 | Comparison tool | `/comparison` |
+| 22 | `cyberlux_testimonials` | 8101 | Testimonials | `/testimonials` |
+| 23 | `cyberlux_wallets` | 8102 | Wallets | `/wallets` |
+| 24 | `cyberlux_support` | 8103 | Support desk | `/support` |
+| 25 | `cyberlux_darknet_atlas` | 8104 | Darknet Atlas taxonomy | `/darknet-atlas` |
+| 26 | `cyberlux_security_analysis` | 8105 | Security analysis | `/security-analysis` |
+| 27 | `cyberlux_mixer` | 8106 | Mixer | `/mixer` |
+| 28 | `cyberlux_secret_layer` | 8107 | Secret Layer | `/secret-layer` |
+| 29 | `cyberlux_trees` | 8108 | Trees | `/trees` |
+| 30 | `cyberlux_presswire` | 8109 | Presswire / news | `/presswire` |
+| 31 | `cyberlux_awards` | 8110 | Awards | `/awards` |
+| 32 | `cyberlux_raffle` | 8111 | Raffle | `/raffle` |
+| 33 | `cyberlux_game` | 8112 | Game | `/game` |
+| 34 | `cyberlux_webring` | 8113 | Webring | `/webring` |
+| 35 | `cyberlux_conspiracies` | 8114 | Conspiracies | `/conspiracies` |
+| 36 | `cyberlux_sanctuary` | 8115 | Sanctuary | `/sanctuary` |
+| 37 | `cyberlux_dashboard` | 8116 | Personal relay dashboard | `/dashboard` |
+| 38 | `cyberlux_checkout` | 8117 | Checkout flow | `/checkout` |
+| 39 | `cyberlux_vendors` | 8118 | Vendors | `/vendors` |
+| 40 | `cyberlux_sign_in` | 8119 | Sign in | `/sign-in` |
+| 41 | `cyberlux_sign_up` | 8120 | Sign up | `/sign-up` |
+| 42 | `cyberlux_account` | 8121 | Account / mirror map | `/account` |
+| 43 | `cyberlux_w` | 8122 | Shadow nodes / syndicate shell | `/w` |
+
+---
+
+## Live Address File
+
+After Tor is running, save all live addresses to a plain-text file:
+
+```bash
+sudo bash scripts/export-onion-urls.sh
+# writes: onion-urls.txt
+```
+
+`onion-urls.txt` (if present in this directory) contains the resolved `http://…56chars….onion` addresses for all services and is gitignored — it reflects runtime state, not source.
+
+---
+
+## How Addresses Stay Stable
+
+Each service maps to a fixed `HiddenServiceDir` in `/var/lib/tor/`. As long as:
+
+- the `torDir` name in `scripts/onion-nodes.json` does not change, and
+- `/var/lib/tor/<service>/` is preserved (or restored from backup),
+
+the `.onion` address **never rotates**, surviving reboots, rebuilds, and Tor restarts.
+
+Backup/restore:
+
+```bash
+sudo bash scripts/backup-onion-keys.sh    # saves to /var/backups/cyberlux-onion-keys/current
+sudo bash scripts/restore-onion-keys.sh   # restores missing dirs from backup
+```
+
+---
+
+## Notes
+
+- All services run from **one** Next.js instance at `127.0.0.1:3000`.
+- nginx vhosts on `127.0.0.1:8080–8122` proxy to Next with `X-Cyberlux-Node` headers for host-aware routing.
+- Open addresses in **Tor Browser** or **Onion Browser** (iOS). Standard browsers cannot resolve `.onion`.
+- Use `http://` — TLS inside the onion circuit is handled end-to-end by Tor.