Add LAMP web dashboard: bot→MySQL publisher, PHP API, numbers-only page

- webapp/: deployable LAMP app for /var/www/ — ingest.php (token-gated
  writes), api.php (public read-only), schema.sql (live_price +
  signal_reports), vanilla-JS dashboard with plain-English indicator
  readings, .htaccess, deploy README
- web_publisher.py: fire-and-forget publisher (bounded queue + daemon
  thread) with plain-English payload builder; public API contractually
  never raises; disabled unless WEBAPP_INGEST_URL/TOKEN are set
- telegram_bot.py: publish hooks (tick in WS loop, report in
  _update_level_cache); _candle_loop per-iteration guard so a failing
  scan can never kill an auto-scan loop; quiet heartbeat teardown
- test_all.py: Module 13 — 6 resilience tests (never-raise contract,
  worker survival, candle-loop survival); suite 189/189
- .gitignore: webapp/config.php (server-side secrets)

Verified end-to-end on a scratch MariaDB 10.11 + PHP 8.3 built-in
server incl. headless-Firefox render of the live page.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KYNEHBuwwy6sgRM9f9sPx5

webapp/.htaccess

@@ -0,0 +1,5 @@
+# Deny web access to config, schema, and docs (needs AllowOverride enabled;
+# if AllowOverride is Off, copy these rules into the vhost instead).
+<FilesMatch "^(config.*\.php|schema\.sql|README\.md)$">
+    Require all denied
+</FilesMatch>

webapp/README.md

@@ -0,0 +1,65 @@
+# ForexBot2 web dashboard (LAMP)
+
+Numbers-only live dashboard: latest XAU/USD price plus each timeframe's
+signal, indicator values, and a plain-English reading of every one.
+
+## How it flows
+
+```
+telegram_bot.py (owns the single Twelve Data WebSocket)
+   ├─ every tick  ──►  POST ingest.php  ──►  MySQL live_price   (throttled 1/s)
+   └─ every scan  ──►  POST ingest.php  ──►  MySQL signal_reports
+                                                    │
+browser  ──►  index.html + app.js  ──►  GET api.php ┘
+             (price poll 2 s · reports poll 15 s)
+```
+
+The dashboard needs **no Python on the web server** — only PHP + MySQL.
+The bot can run anywhere with outbound HTTPS to the site.
+
+## Server setup (once)
+
+1. Copy this directory to the web root, e.g. `/var/www/html/webapp/`.
+2. Create DB + tables: `mysql -u root -p < schema.sql`
+   (also create the app user — commands at the bottom of schema.sql).
+3. `cp config.sample.php config.php` and fill in DB credentials and a
+   fresh `ingest_token` (`openssl rand -hex 32`).
+4. Apache must allow `.htaccess` (`AllowOverride FileInfo Limit` or
+   `All`) so config/schema stay unreachable — or copy those deny rules
+   into the vhost. Verify: `curl -I https://site/webapp/config.php`
+   must return 403.
+
+## Bot setup
+
+Set two environment variables where `telegram_bot.py` runs:
+
+```bash
+export WEBAPP_INGEST_URL="https://your-site/webapp/ingest.php"
+export WEBAPP_INGEST_TOKEN="<same token as config.php>"
+```
+
+Unset = publishing is disabled and the bot behaves exactly as before.
+Publishing is fire-and-forget (bounded queue + daemon thread): a dead
+web server can never block or slow the bot.
+
+## Security notes (public access)
+
+- `api.php` is read-only and public by design; `ingest.php` requires the
+  shared token (use HTTPS so it isn't sent in the clear).
+- `config.php` / `schema.sql` are denied by `.htaccess`.
+- Optional hardening: rate-limit `api.php` (mod_evasive/fail2ban), and
+  restrict `ingest.php` to the bot host's IP in the vhost.
+
+## Data growth
+
+- `live_price`: 1 row per symbol (upserted in place).
+- `signal_reports`: ~400 rows/day for XAU (M5+M15+H1+H4) — ~150k
+  rows/year, no retention job needed. It doubles as a durable log of
+  every signal the engine produced (the `payload` column holds the full
+  report JSON).
+
+## Local smoke test (no Apache needed)
+
+```bash
+php -S 127.0.0.1:8090 -t webapp/   # then open http://127.0.0.1:8090/
+```

webapp/api.php

@@ -0,0 +1,79 @@
+<?php
+// Public read-only API for the dashboard page.
+// GET api.php            → latest price + latest report per timeframe
+// GET api.php?what=price → latest price only (cheap 2-second poll)
+declare(strict_types=1);
+
+header('Content-Type: application/json; charset=utf-8');
+header('Cache-Control: no-store');
+
+function fail(int $code, string $msg): never {
+    http_response_code($code);
+    echo json_encode(['ok' => false, 'error' => $msg]);
+    exit;
+}
+
+if ($_SERVER['REQUEST_METHOD'] !== 'GET') {
+    fail(405, 'GET only');
+}
+
+$cfg = require __DIR__ . '/config.php';
+
+$symbol = (string)($_GET['symbol'] ?? $cfg['symbols'][0]);
+if (!in_array($symbol, $cfg['symbols'], true)) {
+    fail(400, 'unknown symbol');
+}
+$what = (string)($_GET['what'] ?? 'all');
+
+try {
+    $pdo = new PDO($cfg['db_dsn'], $cfg['db_user'], $cfg['db_pass'], [
+        PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
+    ]);
+} catch (PDOException $e) {
+    fail(500, 'db unavailable');
+}
+
+$out = ['ok' => true, 'server_time' => gmdate('Y-m-d H:i:s')];
+
+try {
+    $st = $pdo->prepare(
+        'SELECT price, prev_price, tick_at,
+                TIMESTAMPDIFF(SECOND, tick_at, UTC_TIMESTAMP()) AS age_sec
+         FROM live_price WHERE symbol = :s'
+    );
+    $st->execute([':s' => $symbol]);
+    $row = $st->fetch(PDO::FETCH_ASSOC);
+    $out['price'] = $row === false ? null : [
+        'price' => (float)$row['price'],
+        'prev_price' => $row['prev_price'] === null ? null : (float)$row['prev_price'],
+        'tick_at' => $row['tick_at'],
+        'age_sec' => (int)$row['age_sec'],
+    ];
+
+    if ($what !== 'price') {
+        $st = $pdo->prepare(
+            'SELECT r.timeframe, r.payload, r.updated_at,
+                    TIMESTAMPDIFF(SECOND, r.updated_at, UTC_TIMESTAMP()) AS age_sec
+             FROM signal_reports r
+             JOIN (SELECT timeframe, MAX(id) AS mid
+                   FROM signal_reports WHERE symbol = :s
+                   GROUP BY timeframe) x ON x.mid = r.id'
+        );
+        $st->execute([':s' => $symbol]);
+        $reports = [];
+        foreach ($st->fetchAll(PDO::FETCH_ASSOC) as $r) {
+            $p = json_decode((string)$r['payload'], true);
+            if (is_array($p)) {
+                $p['stored_at'] = $r['updated_at'];
+                $p['age_sec'] = (int)$r['age_sec'];
+                $reports[$r['timeframe']] = $p;
+            }
+        }
+        $out['reports'] = $reports;
+    }
+} catch (PDOException $e) {
+    error_log('api.php: ' . $e->getMessage());
+    fail(500, 'db error');
+}
+
+echo json_encode($out, JSON_UNESCAPED_UNICODE);

webapp/app.js

@@ -0,0 +1,286 @@
+/* ForexBot2 dashboard — polls api.php, renders numbers + plain English.
+   No frameworks, no build step. All text lands via textContent. */
+"use strict";
+
+const API = "api.php";
+const PRICE_POLL_MS = 2000;
+const REPORT_POLL_MS = 15000;
+const TF_ORDER = ["5min", "15min", "1h", "4h"];
+const TF_LABEL = { "5min": "M5", "15min": "M15", "1h": "H1", "4h": "H4" };
+const TF_SECONDS = { "5min": 300, "15min": 900, "1h": 3600, "4h": 14400 };
+
+const SIG_TEXT = {
+  STRONG_BUY: "▲ STRONG BUY", BUY: "▲ BUY", NEUTRAL: "— NEUTRAL",
+  SELL: "▼ SELL", STRONG_SELL: "▼ STRONG SELL",
+};
+const SIG_CLASS = {
+  STRONG_BUY: "sig-buy", BUY: "sig-buy", NEUTRAL: "sig-neutral",
+  SELL: "sig-sell", STRONG_SELL: "sig-sell",
+};
+const IND_LABEL = {
+  ema_trend: "EMA trend", rsi: "RSI", macd: "MACD", bollinger: "Bollinger",
+  adx: "ADX", roc: "Momentum (ROC)", keltner: "Keltner", divergence: "Divergence",
+  candlestick: "Candlestick", atr: "Volatility (ATR)",
+};
+const IND_ORDER = ["ema_trend", "rsi", "macd", "roc", "keltner", "bollinger",
+                   "adx", "divergence", "candlestick", "atr"];
+
+const state = { price: null, reports: {}, activeTf: "5min", lastPrice: null };
+
+const $ = (id) => document.getElementById(id);
+const el = (tag, cls, text) => {
+  const n = document.createElement(tag);
+  if (cls) n.className = cls;
+  if (text !== undefined) n.textContent = text;
+  return n;
+};
+
+// ── polling ──────────────────────────────────────────────────────────
+
+async function fetchJson(url) {
+  const r = await fetch(url, { cache: "no-store" });
+  if (!r.ok) throw new Error("HTTP " + r.status);
+  return r.json();
+}
+
+async function pollPrice() {
+  try {
+    const d = await fetchJson(API + "?what=price");
+    if (d.ok) { state.price = d.price; hideError(); renderPrice(); }
+  } catch (e) { showError("Price feed unreachable — retrying…"); }
+}
+
+async function pollReports() {
+  try {
+    const d = await fetchJson(API);
+    if (d.ok) {
+      state.price = d.price;
+      state.reports = d.reports || {};
+      if (!state.reports[state.activeTf]) {
+        const first = TF_ORDER.find(tf => state.reports[tf]);
+        if (first) state.activeTf = first;
+      }
+      hideError();
+      renderPrice(); renderStrip(); renderDetail();
+    }
+  } catch (e) { showError("Server unreachable — retrying…"); }
+}
+
+function showError(msg) {
+  const b = $("error-banner");
+  b.textContent = msg; b.classList.remove("hidden");
+}
+function hideError() { $("error-banner").classList.add("hidden"); }
+
+// ── rendering ────────────────────────────────────────────────────────
+
+function renderPrice() {
+  const p = state.price;
+  const hero = $("hero-price"), dot = $("feed-dot"), status = $("feed-status");
+  if (!p) {
+    hero.textContent = "—";
+    status.textContent = "no price data yet";
+    dot.className = "dot";
+    return;
+  }
+  const v = Number(p.price);
+  hero.textContent = v.toFixed(2);
+  hero.classList.remove("up", "down");
+  if (state.lastPrice !== null && v !== state.lastPrice) {
+    hero.classList.add(v > state.lastPrice ? "up" : "down");
+  }
+  state.lastPrice = v;
+
+  const age = Number(p.age_sec);
+  if (age <= 60) {
+    dot.className = "dot live";
+    status.textContent = "live · tick " + age + "s ago";
+  } else {
+    dot.className = "dot stale";
+    status.textContent = "feed stale — last tick " + fmtAge(age) + " ago (market closed or bot offline)";
+  }
+}
+
+function renderStrip() {
+  const strip = $("tf-strip");
+  strip.textContent = "";
+  for (const tf of TF_ORDER) {
+    const rep = state.reports[tf];
+    const tile = el("button", "tf-tile");
+    tile.setAttribute("aria-selected", String(tf === state.activeTf));
+    tile.addEventListener("click", () => { state.activeTf = tf; renderStrip(); renderDetail(); });
+    tile.appendChild(el("div", "tf-name", TF_LABEL[tf] || tf));
+    if (rep) {
+      const sig = el("div", "tf-sig", SIG_TEXT[rep.signal] || rep.signal);
+      const cls = SIG_CLASS[rep.signal];
+      if (cls === "sig-buy") sig.style.color = "var(--good)";
+      if (cls === "sig-sell") sig.style.color = "var(--critical)";
+      tile.appendChild(sig);
+      tile.appendChild(el("div", "tf-sub",
+        "grade " + (rep.quality || "F") + " · score " + fmtNum(rep.score, 0)));
+    } else {
+      tile.appendChild(el("div", "tf-sig", "…"));
+      tile.appendChild(el("div", "tf-sub", "no data yet"));
+    }
+    strip.appendChild(tile);
+  }
+}
+
+function renderDetail() {
+  const root = $("detail");
+  root.textContent = "";
+  const tf = state.activeTf;
+  const rep = state.reports[tf];
+  if (!rep) {
+    root.appendChild(el("div", "empty",
+      "No " + (TF_LABEL[tf] || tf) + " report yet — it appears after the next candle close."));
+    return;
+  }
+
+  // verdict card
+  const verdict = el("section", "card");
+  const row = el("div", "verdict-row");
+  const sigChip = el("span", "chip " + (SIG_CLASS[rep.signal] || ""), SIG_TEXT[rep.signal] || rep.signal);
+  row.appendChild(sigChip);
+  row.appendChild(el("span", "chip grade", "grade " + (rep.quality || "F")));
+  row.appendChild(el("span", "chip",
+    "score " + fmtNum(rep.score, 0) + " · conf " + fmtNum(rep.confidence, 0)));
+  verdict.appendChild(row);
+  verdict.appendChild(el("div", "summary", rep.summary || ""));
+  if (rep.regime_plain) verdict.appendChild(el("div", "meta-line", rep.regime_plain));
+  if (rep.mtf_plain) verdict.appendChild(el("div", "meta-line", rep.mtf_plain));
+  const age = Number(rep.age_sec || 0);
+  const staleTxt = age > 2 * (TF_SECONDS[tf] || 3600)
+    ? "  ·  ⚠ this report is stale" : "";
+  verdict.appendChild(el("div", "bar-time",
+    "Signal bar: " + (rep.bar_ts || "?") + " UTC · updated " + fmtAge(age) + " ago" + staleTxt));
+  root.appendChild(verdict);
+
+  // trade setup card
+  if (rep.trade_setup) {
+    const ts = rep.trade_setup;
+    const card = el("section", "card");
+    card.appendChild(el("h2", null, "Trade setup (" + ts.direction + " · " + (ts.strategy || "") + ")"));
+    const grid = el("div", "setup-grid");
+    const stats = [
+      ["Entry", fmtNum(ts.entry, 2)],
+      ["Stop loss", fmtNum(ts.stop_loss, 2)],
+      ["Target 1", fmtNum(ts.take_profit_1, 2)],
+      ["Target 2", fmtNum(ts.take_profit_2, 2)],
+      ["Risk (per oz)", "$" + fmtNum(ts.risk_usd, 2)],
+      ["Reward : risk", fmtNum(ts.risk_reward, 2)],
+    ];
+    for (const [label, value] of stats) {
+      const s = el("div", "stat");
+      s.appendChild(el("div", "label", label));
+      s.appendChild(el("div", "value", value));
+      grid.appendChild(s);
+    }
+    card.appendChild(grid);
+    root.appendChild(card);
+  }
+
+  // warnings card
+  const warns = rep.warnings_plain || [];
+  if (warns.length) {
+    const card = el("section", "card");
+    card.appendChild(el("h2", null, "Things to know"));
+    const ul = el("ul", "warn-list");
+    warns.forEach((w, i) => {
+      const li = el("li");
+      li.appendChild(el("span", "w-ico", "⚠"));
+      li.appendChild(document.createTextNode(w));
+      if (rep.warnings && rep.warnings[i]) li.title = rep.warnings[i];
+      ul.appendChild(li);
+    });
+    card.appendChild(ul);
+    root.appendChild(card);
+  }
+
+  // indicators table
+  const inds = rep.indicators || {};
+  const keys = IND_ORDER.filter(k => inds[k]).concat(
+    Object.keys(inds).filter(k => !IND_ORDER.includes(k)));
+  if (keys.length) {
+    const card = el("section", "card");
+    card.appendChild(el("h2", null, "What each indicator says"));
+    const tbl = el("table", "ind");
+    const thead = el("thead");
+    const hr = el("tr");
+    for (const h of ["Indicator", "Value", "Reading", "What it means"]) {
+      hr.appendChild(el("th", null, h));
+    }
+    thead.appendChild(hr); tbl.appendChild(thead);
+    const tbody = el("tbody");
+    for (const k of keys) {
+      const ind = inds[k];
+      const tr = el("tr");
+      tr.appendChild(el("td", "ind-name", IND_LABEL[k] || k));
+      tr.appendChild(el("td", "num", fmtIndValue(k, ind.value)));
+      const rd = el("td", "num");
+      const chip = el("span", "chip " + (SIG_CLASS[ind.signal] || ""),
+        SIG_TEXT[ind.signal] || ind.signal);
+      chip.style.fontSize = "12px";
+      rd.appendChild(chip);
+      tr.appendChild(rd);
+      const what = el("td", "ind-plain");
+      what.appendChild(el("div", null, ind.plain || ""));
+      if (ind.description) what.appendChild(el("div", "ind-desc", ind.description));
+      tr.appendChild(what);
+      tbody.appendChild(tr);
+    }
+    tbl.appendChild(tbody);
+    card.appendChild(tbl);
+    root.appendChild(card);
+  }
+}
+
+// ── formatting ───────────────────────────────────────────────────────
+
+function fmtNum(v, dp) {
+  const n = Number(v);
+  return Number.isFinite(n) ? n.toFixed(dp) : "—";
+}
+
+function fmtIndValue(name, v) {
+  const n = Number(v);
+  if (!Number.isFinite(n)) return "—";
+  switch (name) {
+    case "rsi": case "adx": return n.toFixed(1);
+    case "roc": return n.toFixed(2) + "%";
+    case "bollinger": return (n * 100).toFixed(0) + "%";
+    case "atr": return "$" + n.toFixed(2);
+    case "divergence": return String(Math.round(n));
+    case "ema_trend": return n.toFixed(2);
+    default: return n.toFixed(2);
+  }
+}
+
+function fmtAge(sec) {
+  if (sec < 90) return sec + "s";
+  if (sec < 5400) return Math.round(sec / 60) + "m";
+  return (sec / 3600).toFixed(1) + "h";
+}
+
+// ── boot ─────────────────────────────────────────────────────────────
+
+let priceTimer = null, reportTimer = null;
+
+function startPolling() {
+  stopPolling();
+  pollReports();
+  priceTimer = setInterval(pollPrice, PRICE_POLL_MS);
+  reportTimer = setInterval(pollReports, REPORT_POLL_MS);
+}
+function stopPolling() {
+  if (priceTimer) clearInterval(priceTimer);
+  if (reportTimer) clearInterval(reportTimer);
+  priceTimer = reportTimer = null;
+}
+
+document.addEventListener("visibilitychange", () => {
+  if (document.hidden) stopPolling(); else startPolling();
+});
+
+renderStrip();
+startPolling();

webapp/config.sample.php

@@ -0,0 +1,19 @@
+<?php
+// ForexBot2 dashboard config — copy to config.php on the server and edit.
+//   cp config.sample.php config.php
+// config.php is denied to web clients by .htaccess; keep it out of git.
+
+return [
+    // PDO MySQL connection
+    'db_dsn'  => 'mysql:host=127.0.0.1;dbname=forexbot_web;charset=utf8mb4',
+    'db_user' => 'forexbot',
+    'db_pass' => 'CHANGE-ME',
+
+    // Shared secret for ingest.php. Must equal the bot's
+    // WEBAPP_INGEST_TOKEN environment variable. Generate with:
+    //   openssl rand -hex 32
+    'ingest_token' => 'CHANGE-ME-TOO',
+
+    // Symbols the public API will serve (whitelist).
+    'symbols' => ['XAU/USD'],
+];

webapp/index.html

@@ -0,0 +1,42 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>ForexBot2 — XAU/USD live signals</title>
+<link rel="stylesheet" href="style.css">
+</head>
+<body>
+<div class="wrap">
+
+  <header class="top">
+    <div>
+      <div class="brand">ForexBot2</div>
+      <div class="pair">XAU/USD · gold spot</div>
+    </div>
+    <div class="hero">
+      <div class="hero-price" id="hero-price">—</div>
+      <div class="hero-meta">
+        <span class="dot" id="feed-dot" aria-hidden="true"></span>
+        <span id="feed-status">connecting…</span>
+      </div>
+    </div>
+  </header>
+
+  <div class="banner hidden" id="error-banner" role="alert"></div>
+
+  <nav class="tf-strip" id="tf-strip" aria-label="Timeframes"></nav>
+
+  <main id="detail" aria-live="polite"></main>
+
+  <footer class="foot">
+    <p>Signals refresh automatically at each candle close. Live price
+    updates every ~2&nbsp;seconds. All times UTC.</p>
+    <p class="muted">Educational information, not financial advice.
+    Trading involves substantial risk of loss.</p>
+  </footer>
+
+</div>
+<script src="app.js"></script>
+</body>
+</html>

webapp/ingest.php

@@ -0,0 +1,120 @@
+<?php
+// Ingest endpoint — the bot POSTs ticks and signal reports here.
+// Auth: shared token in the JSON body, compared with hash_equals().
+declare(strict_types=1);
+
+header('Content-Type: application/json; charset=utf-8');
+header('Cache-Control: no-store');
+
+function fail(int $code, string $msg): never {
+    http_response_code($code);
+    echo json_encode(['ok' => false, 'error' => $msg]);
+    exit;
+}
+
+if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
+    fail(405, 'POST only');
+}
+
+$cfg = require __DIR__ . '/config.php';
+
+$raw = file_get_contents('php://input');
+if ($raw === false || strlen($raw) > 512 * 1024) {
+    fail(400, 'bad body');
+}
+$msg = json_decode($raw, true);
+if (!is_array($msg)) {
+    fail(400, 'invalid JSON');
+}
+
+$token = (string)($msg['token'] ?? '');
+if ($token === '' || !hash_equals((string)$cfg['ingest_token'], $token)) {
+    fail(403, 'bad token');
+}
+
+$symbol = (string)($msg['symbol'] ?? '');
+if ($symbol === '' || !in_array($symbol, $cfg['symbols'], true)) {
+    fail(400, 'unknown symbol');
+}
+
+try {
+    $pdo = new PDO($cfg['db_dsn'], $cfg['db_user'], $cfg['db_pass'], [
+        PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
+    ]);
+} catch (PDOException $e) {
+    fail(500, 'db unavailable');
+}
+
+$type = (string)($msg['type'] ?? '');
+
+try {
+    if ($type === 'tick') {
+        $price = filter_var($msg['price'] ?? null, FILTER_VALIDATE_FLOAT);
+        if ($price === false || $price === null) {
+            fail(400, 'bad price');
+        }
+        $prev = filter_var($msg['prev'] ?? null, FILTER_VALIDATE_FLOAT);
+        $tickAt = (string)($msg['tick_at'] ?? gmdate('Y-m-d H:i:s'));
+        $st = $pdo->prepare(
+            'INSERT INTO live_price (symbol, price, prev_price, tick_at)
+             VALUES (:s, :p, :pp, :t)
+             ON DUPLICATE KEY UPDATE
+               prev_price = VALUES(prev_price),
+               price      = VALUES(price),
+               tick_at    = VALUES(tick_at)'
+        );
+        $st->execute([
+            ':s' => $symbol,
+            ':p' => $price,
+            ':pp' => ($prev === false || $prev === null) ? null : $prev,
+            ':t' => substr($tickAt, 0, 19),
+        ]);
+        echo json_encode(['ok' => true]);
+        exit;
+    }
+
+    if ($type === 'report') {
+        $tf = (string)($msg['timeframe'] ?? '');
+        $barTs = substr((string)($msg['bar_ts'] ?? ''), 0, 19);
+        $signal = (string)($msg['signal'] ?? '');
+        $quality = (string)($msg['quality'] ?? 'F');
+        $score = filter_var($msg['score'] ?? null, FILTER_VALIDATE_FLOAT);
+        $conf = filter_var($msg['confidence'] ?? null, FILTER_VALIDATE_FLOAT);
+        $payload = $msg['payload'] ?? null;
+        if ($tf === '' || strlen($tf) > 8 || $barTs === '' || $signal === ''
+                || $score === false || $score === null
+                || $conf === false || $conf === null
+                || !is_array($payload)) {
+            fail(400, 'bad report fields');
+        }
+        $st = $pdo->prepare(
+            'INSERT INTO signal_reports
+               (symbol, timeframe, bar_ts, signal_name, quality,
+                score, confidence, payload)
+             VALUES (:s, :tf, :bt, :sig, :q, :sc, :c, :pl)
+             ON DUPLICATE KEY UPDATE
+               signal_name = VALUES(signal_name),
+               quality     = VALUES(quality),
+               score       = VALUES(score),
+               confidence  = VALUES(confidence),
+               payload     = VALUES(payload)'
+        );
+        $st->execute([
+            ':s' => $symbol,
+            ':tf' => $tf,
+            ':bt' => $barTs,
+            ':sig' => substr($signal, 0, 12),
+            ':q' => substr($quality, 0, 2),
+            ':sc' => $score,
+            ':c' => $conf,
+            ':pl' => json_encode($payload, JSON_UNESCAPED_UNICODE),
+        ]);
+        echo json_encode(['ok' => true]);
+        exit;
+    }
+
+    fail(400, 'unknown type');
+} catch (PDOException $e) {
+    error_log('ingest.php: ' . $e->getMessage());
+    fail(500, 'db error');
+}

webapp/schema.sql

@@ -0,0 +1,47 @@
+-- ForexBot2 web dashboard schema (MySQL 8.0+ / MariaDB 10.5+)
+-- Load once:  mysql -u root -p < schema.sql
+-- (edit the database/user names to taste; keep them in sync with config.php)
+
+CREATE DATABASE IF NOT EXISTS forexbot_web
+  CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
+
+USE forexbot_web;
+
+-- Latest tick per symbol — a single row upserted on every published tick
+-- (the bot throttles to 1/s). Tick history is deliberately NOT stored:
+-- XAU produces 100k+ ticks/day; add a separate append table with a purge
+-- job if charting is ever needed.
+CREATE TABLE IF NOT EXISTS live_price (
+  symbol      VARCHAR(16)   NOT NULL PRIMARY KEY,
+  price       DECIMAL(12,5) NOT NULL,
+  prev_price  DECIMAL(12,5) NULL,
+  tick_at     DATETIME      NOT NULL,  -- UTC, set by the bot
+  updated_at  TIMESTAMP     NOT NULL DEFAULT CURRENT_TIMESTAMP
+                            ON UPDATE CURRENT_TIMESTAMP
+) ENGINE=InnoDB;
+
+-- One row per (symbol, timeframe, signal bar). Re-scans of the same bar
+-- (e.g. the bot's level-breach rescan) update the row in place, so the
+-- table is also a clean historical signal log (~400 rows/day for XAU on
+-- M5+M15+H1+H4 — no retention job needed).
+CREATE TABLE IF NOT EXISTS signal_reports (
+  id          BIGINT UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY,
+  symbol      VARCHAR(16)   NOT NULL,
+  timeframe   VARCHAR(8)    NOT NULL,   -- '5min','15min','1h','4h'
+  bar_ts      DATETIME      NOT NULL,   -- signal bar timestamp (UTC)
+  signal_name VARCHAR(12)   NOT NULL,   -- STRONG_BUY..STRONG_SELL
+  quality     VARCHAR(2)    NOT NULL,   -- A+, A, B, C, D, F
+  score       DECIMAL(6,2)  NOT NULL,
+  confidence  DECIMAL(5,2)  NOT NULL,
+  payload     JSON          NOT NULL,   -- full dashboard payload
+  created_at  TIMESTAMP     NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  updated_at  TIMESTAMP     NOT NULL DEFAULT CURRENT_TIMESTAMP
+                            ON UPDATE CURRENT_TIMESTAMP,
+  UNIQUE KEY uq_bar (symbol, timeframe, bar_ts),
+  KEY idx_latest (symbol, timeframe, id)
+) ENGINE=InnoDB;
+
+-- Dedicated app user with least privilege (adjust host/password!):
+-- CREATE USER 'forexbot'@'localhost' IDENTIFIED BY 'CHANGE-ME';
+-- GRANT SELECT, INSERT, UPDATE ON forexbot_web.* TO 'forexbot'@'localhost';
+-- FLUSH PRIVILEGES;

webapp/style.css

@@ -0,0 +1,153 @@
+/* ForexBot2 dashboard — numbers-only stat tiles.
+   Color roles follow the validated reference palette:
+   status good #0ca30c · warning #fab219 · critical #d03b3b (fixed, never
+   themed); surfaces #fcfcfb / #1a1a19; text wears text tokens only. */
+
+:root {
+  color-scheme: light;
+  --surface-1: #fcfcfb;
+  --surface-2: #f4f3f0;
+  --border: #e3e2dd;
+  --text-primary: #0b0b0b;
+  --text-secondary: #52514e;
+  --text-muted: #8a8985;
+  --good: #0ca30c;
+  --warning: #b97e00;      /* darkened warning for light-surface text */
+  --warning-bg: #fff6e0;
+  --critical: #d03b3b;
+  --chip-neutral-bg: #ececea;
+  --good-bg: #e8f6e8;
+  --critical-bg: #fbe9e9;
+}
+@media (prefers-color-scheme: dark) {
+  :root {
+    color-scheme: dark;
+    --surface-1: #1a1a19;
+    --surface-2: #232322;
+    --border: #3a3a37;
+    --text-primary: #ffffff;
+    --text-secondary: #c3c2b7;
+    --text-muted: #8f8e86;
+    --good: #2fbf2f;
+    --warning: #fab219;
+    --warning-bg: #33290e;
+    --critical: #e66767;
+    --chip-neutral-bg: #32322f;
+    --good-bg: #14320f;
+    --critical-bg: #3b1414;
+  }
+}
+
+* { box-sizing: border-box; }
+body {
+  margin: 0;
+  background: var(--surface-1);
+  color: var(--text-primary);
+  font: 15px/1.5 system-ui, -apple-system, "Segoe UI", Roboto, sans-serif;
+}
+.wrap { max-width: 980px; margin: 0 auto; padding: 20px 16px 40px; }
+
+/* header / hero figure */
+.top {
+  display: flex; justify-content: space-between; align-items: flex-end;
+  gap: 16px; flex-wrap: wrap; margin-bottom: 18px;
+}
+.brand { font-size: 20px; font-weight: 700; }
+.pair { color: var(--text-secondary); }
+.hero { text-align: right; }
+.hero-price {
+  font-size: 52px; font-weight: 650; line-height: 1.05;
+  font-variant-numeric: tabular-nums;
+  transition: color .4s ease;
+}
+.hero-price.up { color: var(--good); }
+.hero-price.down { color: var(--critical); }
+.hero-meta { color: var(--text-muted); font-size: 13px; }
+.dot {
+  display: inline-block; width: 8px; height: 8px; border-radius: 50%;
+  background: var(--text-muted); margin-right: 6px;
+}
+.dot.live { background: var(--good); }
+.dot.stale { background: var(--warning); }
+
+.banner {
+  background: var(--warning-bg); color: var(--text-primary);
+  border: 1px solid var(--warning); border-radius: 8px;
+  padding: 10px 14px; margin-bottom: 14px;
+}
+.hidden { display: none; }
+
+/* timeframe strip — stat tiles */
+.tf-strip {
+  display: grid; grid-template-columns: repeat(4, 1fr);
+  gap: 10px; margin-bottom: 18px;
+}
+@media (max-width: 640px) { .tf-strip { grid-template-columns: repeat(2, 1fr); } }
+.tf-tile {
+  background: var(--surface-2); border: 1px solid var(--border);
+  border-radius: 10px; padding: 10px 12px; cursor: pointer;
+  text-align: left; font: inherit; color: inherit;
+}
+.tf-tile[aria-selected="true"] { border-color: var(--text-secondary); box-shadow: inset 0 0 0 1px var(--text-secondary); }
+.tf-tile .tf-name { font-size: 12px; color: var(--text-secondary); text-transform: uppercase; letter-spacing: .04em; }
+.tf-tile .tf-sig { font-weight: 700; margin-top: 2px; }
+.tf-tile .tf-sub { font-size: 12px; color: var(--text-muted); font-variant-numeric: tabular-nums; }
+
+/* cards */
+.card {
+  background: var(--surface-2); border: 1px solid var(--border);
+  border-radius: 12px; padding: 16px 18px; margin-bottom: 14px;
+}
+.card h2 {
+  margin: 0 0 10px; font-size: 13px; font-weight: 600;
+  color: var(--text-secondary); text-transform: uppercase; letter-spacing: .05em;
+}
+.summary { font-size: 17px; }
+.meta-line { color: var(--text-secondary); margin-top: 8px; }
+.bar-time { color: var(--text-muted); font-size: 13px; margin-top: 8px; }
+
+/* signal + grade chips — status meaning always icon+word, never color alone */
+.chip {
+  display: inline-block; padding: 2px 10px; border-radius: 999px;
+  font-size: 13px; font-weight: 700; background: var(--chip-neutral-bg);
+  color: var(--text-primary); white-space: nowrap;
+}
+.chip.sig-buy  { background: var(--good-bg); color: var(--good); }
+.chip.sig-sell { background: var(--critical-bg); color: var(--critical); }
+.chip.grade { font-variant-numeric: tabular-nums; }
+.verdict-row { display: flex; gap: 8px; align-items: center; flex-wrap: wrap; margin-bottom: 10px; }
+
+/* trade setup */
+.setup-grid {
+  display: grid; grid-template-columns: repeat(auto-fit, minmax(120px, 1fr));
+  gap: 10px;
+}
+.setup-grid .stat .label { font-size: 12px; color: var(--text-secondary); }
+.setup-grid .stat .value { font-size: 20px; font-weight: 650; font-variant-numeric: tabular-nums; }
+
+/* warnings */
+.warn-list { list-style: none; margin: 0; padding: 0; }
+.warn-list li { padding: 4px 0; color: var(--text-secondary); }
+.warn-list .w-ico { color: var(--warning); margin-right: 8px; }
+
+/* indicators table */
+table.ind {
+  width: 100%; border-collapse: collapse; font-size: 14px;
+}
+table.ind th {
+  text-align: left; font-size: 12px; color: var(--text-secondary);
+  text-transform: uppercase; letter-spacing: .04em;
+  border-bottom: 1px solid var(--border); padding: 6px 8px;
+}
+table.ind td { border-bottom: 1px solid var(--border); padding: 8px; vertical-align: top; }
+table.ind tr:last-child td { border-bottom: none; }
+td.num { font-variant-numeric: tabular-nums; white-space: nowrap; }
+.ind-name { font-weight: 600; white-space: nowrap; }
+.ind-plain { }
+.ind-desc { color: var(--text-muted); font-size: 12.5px; margin-top: 2px; }
+
+.foot { color: var(--text-muted); font-size: 13px; margin-top: 24px; }
+.muted { color: var(--text-muted); }
+.empty {
+  color: var(--text-muted); text-align: center; padding: 40px 0;
+}