AXP Markets production Web Push setup
=====================================

Configure these values in the production PHP/Apache environment. Do not put
the private key in JavaScript, HTML, the notification-test directory, or a
committed project configuration file.

AXP_VAPID_SUBJECT=mailto:notifications@axpmarkets.com
AXP_VAPID_PUBLIC_KEY=BBOORthPAzuUyJhhLAJ0UpuLz-s_EbLj5nZKpQh5Yd1xh9tqEjN78Q27NvhggvHnrJm-6cGvj2KZB0PRc-A558o
AXP_VAPID_PRIVATE_KEY_PEM=<the newly generated EC P-256 PEM private key>

The private key was generated locally and is intentionally not stored in this
project or printed in this guide. Obtain it from the secure generation output
and store it only in the hosting provider's protected environment/secrets
configuration.

If environment variables are unavailable on shared hosting:

1. Create a PHP secrets/config file outside the web document root.
2. Store the three values there, with restrictive file permissions.
3. Load that file through the server bootstrap/configuration before
   secure/Includes/web-push-config.php is used, or expose the values through
   the hosting account's PHP configuration.
4. Never place the private key in a public web directory or return it through
   HTTP. The public key alone may be returned to authenticated subscription
   bootstrap code.

The existing notification-test key pair was not changed. Push dispatch and the
database migration remain disabled/not executed.
