Harden web root, secrets and realtime auth

- .htaccess: refuse .git, .env, docker, nodejs, sdlc*, scripts, archives and
  app internals; security headers, HSTS over TLS, optional HTTPS redirect
- uploads served through app/file.php to signed-in users only
- Apache/PHP hardening config for the container (ServerTokens, expose_php)
- least-privilege DB account and APP_SECRET_KEY via docker/php/provision.php;
  SMTP passwords re-encrypted with a random IV (secret_box.php)
- Socket.IO rooms from a PHP-signed token; /emit and cron refuse empty secrets
- escape notification text; CLI guards on build scripts; no fixed demo password

app/assets/utils/cron_auth.php

@@ -11,8 +11,9 @@ header('Content-Type: application/json; charset=utf-8');
 require_once __DIR__ . '/../../config.php';
 require_once __DIR__ . '/../../dbconn.php';
 
-$secret = $_SERVER['HTTP_X_CRON_SECRET'] ?? '';
-if (!defined('NODE_EMIT_SECRET') || $secret !== NODE_EMIT_SECRET) {
+// An empty configured secret must never match an empty header.
+$secret = (string)($_SERVER['HTTP_X_CRON_SECRET'] ?? '');
+if (!defined('NODE_EMIT_SECRET') || NODE_EMIT_SECRET === '' || !hash_equals((string)NODE_EMIT_SECRET, $secret)) {
     http_response_code(403);
     exit(json_encode(['success' => 0, 'message' => 'Forbidden']));
 }