Harden web root, secrets and realtime auth

- .htaccess: refuse .git, .env, docker, nodejs, sdlc*, scripts, archives and
  app internals; security headers, HSTS over TLS, optional HTTPS redirect
- uploads served through app/file.php to signed-in users only
- Apache/PHP hardening config for the container (ServerTokens, expose_php)
- least-privilege DB account and APP_SECRET_KEY via docker/php/provision.php;
  SMTP passwords re-encrypted with a random IV (secret_box.php)
- Socket.IO rooms from a PHP-signed token; /emit and cron refuse empty secrets
- escape notification text; CLI guards on build scripts; no fixed demo password

app/assets/utils/classes/SmtpManager.php

@@ -1,5 +1,6 @@
 <?php
 require_once __DIR__ . '/../module/mailer.php';
+require_once __DIR__ . '/../secret_box.php';
 
 class SmtpManager
 {
@@ -173,7 +174,7 @@ class SmtpManager
 
     private function encryptPassword(string $plain): string
     {
-        return openssl_encrypt($plain, $this->method, $this->pinkey, 0, $this->iv);
+        return secret_encrypt($plain, $this->pinkey);
     }
 }
 ?>