Harden web root, secrets and realtime auth

- .htaccess: refuse .git, .env, docker, nodejs, sdlc*, scripts, archives and
  app internals; security headers, HSTS over TLS, optional HTTPS redirect
- uploads served through app/file.php to signed-in users only
- Apache/PHP hardening config for the container (ServerTokens, expose_php)
- least-privilege DB account and APP_SECRET_KEY via docker/php/provision.php;
  SMTP passwords re-encrypted with a random IV (secret_box.php)
- Socket.IO rooms from a PHP-signed token; /emit and cron refuse empty secrets
- escape notification text; CLI guards on build scripts; no fixed demo password

app/include_setting_sidebar.php

@@ -1,6 +1,9 @@
 <?php
   $current_page = basename($_SERVER['PHP_SELF']);
   $setting_role = $_SESSION['login_role'] ?? 'viewer';
+  // Users Access and SMTP are owner/admin only (their API engines enforce it);
+  // don't offer other roles a page that can only answer "Access denied".
+  $setting_can_admin = in_array($setting_role, ['owner', 'admin'], true);
 ?>
 
 <!-- SIDEBAR -->
@@ -36,6 +39,7 @@
       </a>
     </li>
 
+    <?php if ($setting_can_admin): ?>
     <li>
       <a class="nav-link <?php echo $current_page === 'users.php' ? 'active' : ''; ?>"
          href="<?php echo $server_url?>setting/users.php">
@@ -51,6 +55,7 @@
         <span class="nav-text">SMTP Setting</span>
       </a>
     </li>
+    <?php endif; ?>
 
     <li>
       <a class="nav-link <?php echo $current_page === 'system_config.php' ? 'active' : ''; ?>"