fix login and configurations

app/config.example.php

@@ -22,6 +22,33 @@ if(true){
 	$time_zone 		= "Asia/Bangkok";
 }
 
+// ── Real-time Node.js server ─────────────────────────────────────────────────
+// Base URL the browser uses to reach nodejs/server.js (Socket.IO). Must match
+// PORT in nodejs/.env.
+if (!defined('NODE_PUBLIC_URL')) {
+	define('NODE_PUBLIC_URL', 'http://localhost:3000');
+}
+// Server-to-server calls (PHP → Node /emit, and Node scheduler → PHP cron
+// endpoints) authenticate with this shared secret — must match EMIT_SECRET
+// in nodejs/.env exactly.
+if (!defined('NODE_EMIT_URL')) {
+	define('NODE_EMIT_URL', 'http://127.0.0.1:3000/emit');
+}
+if (!defined('NODE_EMIT_SECRET')) {
+	define('NODE_EMIT_SECRET', 'YOUR_NODE_EMIT_SECRET'); // must match nodejs/.env EMIT_SECRET
+}
+
+// ── Usage packages ───────────────────────────────────────────────────────────
+// Keyed by company_list.package (defaults to 'starter'). Read by UsageGuard to
+// enforce daily/weekly action limits and which features lock once exceeded.
+$packages = [
+	'starter' => [
+		'daily_limit'   => 30,
+		'weekly_limit'  => 100,
+		'lock_on_limit' => ['dashboard'],
+	],
+];
+
 
 
 // unique key — used for SMTP password encryption, keep consistent across deploys