# iTzAYDiN-BOT V8.1 — PasarGuard Connectivity Fix

This patch keeps V8 Commerce unchanged and hardens PasarGuard connectivity.

## Fixes
- Separate optional `pg_api_url` from the public Panel URL.
- Normalize copied Dashboard/Login/API URLs back to the correct API base.
- Detect Cloudflare JS/Managed Challenge HTML and return a short actionable diagnostic instead of dumping the challenge page into Telegram.
- Capture effective URL, content type, redirects and response headers for diagnostics.
- PasarGuard API Key auth sends the official `X-Api-Key` header and the supported `Authorization: ApiKey ...` compatibility form.
- Password login explicitly submits OAuth2 `grant_type=password` to `/api/admin/token`.
- Telegram add flow now asks for the PasarGuard API Endpoint before authentication.
- Existing PasarGuard backends can change/test their API Endpoint from Telegram or iTz PasarGuard Hub.
- Database migration adds nullable `marzban_panel.pg_api_url`; empty means use `url_panel`.

## Cloudflare note
Server-to-server API calls cannot execute a browser JavaScript challenge. If the public panel is behind a Cloudflare challenge, allow/skip challenge for the API path on infrastructure you control, or point `pg_api_url` to a separate API hostname that reaches the same PasarGuard origin without a browser challenge.
