Impment webcron and internal scheduling methods and change settings to a key value store

routes/web.php

@@ -1,8 +1,11 @@
 <?php
 
-use Illuminate\Support\Facades\Route;
 use Inertia\Inertia;
-use App\Http\Controllers\TodoController;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Route;
+use Illuminate\Support\Facades\Artisan;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Cache;
 use App\Http\Controllers\InvoiceController;
 use App\Http\Controllers\CustomerController;
 use App\Http\Controllers\ProductController;
@@ -61,6 +64,51 @@
     Route::get('proceduralDocumentation', function () {
         return Inertia::render('ProceduralDocumentation');
     })->name('proceduralDocumentation');
+
+
+    /*
+    |--------------------------------------------------------------------------
+    | Web cron route
+    |--------------------------------------------------------------------------
+    |
+    | Example: GET /webcron?token=SECRET or set header X-WEBCron-Token: SECRET
+    | Configure secret in .env as WEBCRON_SECRET (optional). If no secret is set,
+    | the route is open (not recommended in production).
+    |
+    */
+    Route::get('/webcron', function (Request $request) {
+        // only allow if scheduling method is webcron
+        $method = \App\Models\Setting::where('key', 'app.schedule_method')->value('value') ?? 'internal';
+        if ($method !== 'webcron') {
+            return response('Not Found', 404);
+        }
+
+        $secret = env('WEBCRON_SECRET', null);
+
+        // basic token protection
+        if ($secret) {
+            $token = $request->query('token') ?? $request->header('X-WEBCron-Token');
+            if (!$token || !hash_equals((string)$secret, (string)$token)) {
+                return response('Forbidden', 403);
+            }
+        }
+
+        // quick throttle to avoid abuse (server-side)
+        $cacheKey = 'caramel_webcron_last_run';
+        if (\Illuminate\Support\Facades\Cache::has($cacheKey)) {
+            return response('Throttled', 429);
+        }
+        Cache::put($cacheKey, true, 55);
+
+        try {
+            Log::info('Triggering scheduler via /webcron route');
+            Artisan::call('schedule:run');
+            return response('OK', 200);
+        } catch (\Throwable $e) {
+            Log::error('Error running scheduler: ' . $e->getMessage());
+            return response('Error', 500);
+        }
+    });
 });