Harden web root, secrets and realtime auth

- .htaccess: refuse .git, .env, docker, nodejs, sdlc*, scripts, archives and
  app internals; security headers, HSTS over TLS, optional HTTPS redirect
- uploads served through app/file.php to signed-in users only
- Apache/PHP hardening config for the container (ServerTokens, expose_php)
- least-privilege DB account and APP_SECRET_KEY via docker/php/provision.php;
  SMTP passwords re-encrypted with a random IV (secret_box.php)
- Socket.IO rooms from a PHP-signed token; /emit and cron refuse empty secrets
- escape notification text; CLI guards on build scripts; no fixed demo password

demo_seed.php

@@ -91,7 +91,9 @@ echo "--- Owner account & company ---\n";
 
 $demo_username = 'admin';
 $demo_email    = 'thanakorn.inbox@gmail.com';
-$demo_password = 'Demo@12345';
+// Never a fixed password in the repository: DEMO_PASSWORD from the environment,
+// or a random one that is printed once below.
+$demo_password = getenv('DEMO_PASSWORD') ?: ('Demo-' . bin2hex(random_bytes(6)));
 $demo_channel  = 'demo';
 
 $sth = $pdo1->prepare("SELECT user_id FROM user WHERE username = :u OR email = :e LIMIT 1");