closing security gap [ignore guarding change for now]

app/login/api/engine/back.php

@@ -22,6 +22,7 @@
  */
 
 require '../../../session.php';
+define('UNAUTHENTICATED_ROUTE', true);
 require '../../../assets/utils/db_auth.php';
 
 // Intentional 1-second delay — prevents timing attacks on session enumeration

app/login/api/engine/login_confirm.php

@@ -51,6 +51,7 @@
 require '../../../session.php';
 require '../../../config.php';
 require '../../../preset.php';
+define('UNAUTHENTICATED_ROUTE', true);
 require '../../../assets/utils/db_auth.php';
 
 // ── Step 1: Load session state written by login_otp.php ───────────────────────

app/login/api/engine/login_otp.php

@@ -60,6 +60,7 @@
 require '../../../session.php';
 require '../../../config.php';
 require '../../../preset.php';
+define('UNAUTHENTICATED_ROUTE', true);
 require '../../../assets/utils/db_auth.php';
 
 // ── Step 1: Resolve user_id from username or email (case-insensitive) ────────

app/login/api/engine/request_new_otp.php

@@ -45,6 +45,7 @@
 require '../../../session.php';
 require '../../../config.php';
 require '../../../preset.php';
+define('UNAUTHENTICATED_ROUTE', true);
 require '../../../assets/utils/db_auth.php';
 
 // ── Step 1: Reload credentials from session ───────────────────────────────────