[ZulTheDev]

What this adds

• Make Redis the authoritative store for public comments when configured.
• Migrate existing server/comments.json records into Redis on server startup.
• Add a Redis per-device comment index and atomic comment writes.
• Stop silently reporting disk persistence when Redis is unavailable; public/admin comment APIs now return an explicit persistence error unless ALLOW_LOCAL_COMMENT_FALLBACK=true.
• Add Ko-fi webhook storage for tips and Shop Orders in Redis.
• Add a local-admin Ko-fi & Buy-first editor.
• Keep Buy-first protected content private in Redis; publish only card metadata to client/public/content.json.
• Add purchase verification by Ko-fi transaction ID + purchase email and short-lived/renewable access tokens.
• Add public Tip via Ko-fi and Buy-first purchase/unlock UI.
• Document KO_FI_VERIFICATION_TOKEN, Redis, and access TTL environment settings.

Required deployment configuration

REDIS_URL is required for shared durable comments, Ko-fi event storage, and Buy-first verification.

KO_FI_VERIFICATION_TOKEN is required for the Ko-fi webhook.

Configure the Ko-fi webhook endpoint as /api/kofi/webhook on the deployed API.

Notes

Ko-fi's current API integration is webhook-based for payment events, so the public tip action opens the creator's Ko-fi page while the backend records the resulting payment webhook.

No R2, DeepSeek, Astro, CTF writeup, or existing comment UI functionality was removed.