review code pattern consistency

app/login/api/engine/login_otp.php

@@ -141,7 +141,7 @@ if (password_verify(trim($data["password"]), $temp["password"])) {
         $verify_url = $base_url . '/login/verify.php?token=' . $token;
 
         try {
-            require_once $include_url . 'assets/utils/module/mailer.php';
+            require_once '../../../assets/utils/module/mailer.php';
             $mailer = new mailer(['pdo1' => $pdo1]);
             $mailer->send_email([
                 'company_id'   => 0,

app/login/api/engine/onboarding.php

@@ -73,7 +73,8 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
     $csrf = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
     if (empty($csrf) || $csrf !== ($_SESSION['csrf_token'] ?? '')) {
         http_response_code(403);
-        exit(json_encode(['message' => 'Invalid request.']));
+        $answer['message'] = 'Invalid request.';
+        exit(json_encode($answer));
     }
 }
 
@@ -142,7 +143,7 @@ try {
     // Sends a test email to the onboarding user's registered address.
     // If the mailer throws or exits, no DB records have been created yet,
     // so the user can correct their SMTP settings and retry cleanly.
-    require_once $include_url . 'assets/utils/module/mailer.php';
+    require_once '../../../assets/utils/module/mailer.php';
 
     $mailer = new mailer(['pdo1' => $pdo1]);
     $mailer->send_email([

app/login/api/engine/register.php

@@ -60,7 +60,8 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
     $csrf = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
     if (empty($csrf) || $csrf !== ($_SESSION['csrf_token'] ?? '')) {
         http_response_code(403);
-        exit(json_encode(['message' => 'Invalid request.']));
+        $answer['message'] = 'Invalid request.';
+        exit(json_encode($answer));
     }
 }
 
@@ -177,7 +178,7 @@ try {
     // Uses $SMTP from config.php (system-level, not company SMTP) because the
     // user does not have a company yet at registration time.
     // If the mailer fails it exits internally with its own error JSON response.
-    require_once $include_url . 'assets/utils/module/mailer.php';
+    require_once '../../../assets/utils/module/mailer.php';
 
     $mailer = new mailer(['pdo1' => $pdo1]);
     $mailer->send_email([

app/login/api/engine/request_reset_otp.php

@@ -9,7 +9,8 @@ $identifier = strtolower(trim($data['identifier'] ?? ''));
 
 if (!$identifier) {
     http_response_code(422);
-    exit(json_encode(['success' => 0, 'message' => 'Please enter your username or email.']));
+    $answer['message'] = 'Please enter your username or email.';
+    exit(json_encode($answer));
 }
 
 $sth = $pdo1->prepare(
@@ -20,13 +21,14 @@ $user = $sth->fetch(PDO::FETCH_ASSOC);
 
 if (!$user) {
     http_response_code(404);
-    exit(json_encode(['success' => 0, 'message' => 'No account found with that username or email.']));
+    $answer['message'] = 'No account found with that username or email.';
+    exit(json_encode($answer));
 }
 
 $user_id    = (int)$user['user_id'];
 $company_id = (int)($user['default_company'] ?? 0);
 
-require_once $include_url . 'assets/utils/classes/PasswordResetManager.php';
+require_once '../../../assets/utils/classes/PasswordResetManager.php';
 
 $manager = new PasswordResetManager($pdo1, $pdo2, $include_url, $SMTP, $pinkey);
 $manager->handleRequestOtp($user_id, $company_id);

app/login/api/engine/reset_password_otp.php

@@ -6,12 +6,13 @@ require '../../../assets/utils/db_auth.php';
 
 if (empty($_SESSION['reset_user_id'])) {
     http_response_code(400);
-    exit(json_encode(['success' => 0, 'message' => 'No active reset request. Please request a new OTP.']));
+    $answer['message'] = 'No active reset request. Please request a new OTP.';
+    exit(json_encode($answer));
 }
 
 $user_id = (int)$_SESSION['reset_user_id'];
 
-require_once $include_url . 'assets/utils/classes/PasswordResetManager.php';
+require_once '../../../assets/utils/classes/PasswordResetManager.php';
 
 $manager = new PasswordResetManager($pdo1, $pdo2, $include_url, $SMTP, $pinkey);
 $manager->handleConfirmReset($user_id, $data);