Harden web root, secrets and realtime auth

- .htaccess: refuse .git, .env, docker, nodejs, sdlc*, scripts, archives and
  app internals; security headers, HSTS over TLS, optional HTTPS redirect
- uploads served through app/file.php to signed-in users only
- Apache/PHP hardening config for the container (ServerTokens, expose_php)
- least-privilege DB account and APP_SECRET_KEY via docker/php/provision.php;
  SMTP passwords re-encrypted with a random IV (secret_box.php)
- Socket.IO rooms from a PHP-signed token; /emit and cron refuse empty secrets
- escape notification text; CLI guards on build scripts; no fixed demo password

app/config.example.php

@@ -2,13 +2,15 @@
 
 //<><><><><><><><> MAIN CONFIG <><><><><><><><>//
 if(true){
-	$isTest 		= "master";
 	$base_url		= "/your-app-folder/";        // e.g. "/wms-app/" — folder name under web root
 	$server_url 	= $base_url."app/";
 	$include_url	= $_SERVER['DOCUMENT_ROOT'].$server_url;
 
 	$db_server		= "localhost";
-	$db_user 		= "root";
+	// Use a dedicated account with only SELECT, INSERT, UPDATE, DELETE, CREATE,
+	// INDEX, CREATE TEMPORARY TABLES, LOCK TABLES, EXECUTE on wms and wms2 —
+	// never root (docker/php/provision.php shows the grants).
+	$db_user 		= "wms_app";
 	$db_pass		= "YOUR_DB_PASSWORD";
 	$db_type		= "mysql";
 	$db_database 	= "wms";
@@ -69,7 +71,13 @@ $packages = [
 
 
 
-// unique key — used for SMTP password encryption, keep consistent across deploys
+// Key for stored SMTP passwords (assets/utils/secret_box.php): a long random
+// string, e.g. `openssl rand -hex 32`. Keep it stable across deploys — changing it
+// makes saved SMTP passwords unreadable. Never commit the real value.
+if (!defined('APP_SECRET_KEY')) {
+	define('APP_SECRET_KEY', 'YOUR_APP_SECRET_KEY');
+}
+// Legacy fixed key: only used to read SMTP passwords saved before APP_SECRET_KEY.
 $pinkey = "wms";
 
 $SMTP = [];