Harden web root, secrets and realtime auth

- .htaccess: refuse .git, .env, docker, nodejs, sdlc*, scripts, archives and
  app internals; security headers, HSTS over TLS, optional HTTPS redirect
- uploads served through app/file.php to signed-in users only
- Apache/PHP hardening config for the container (ServerTokens, expose_php)
- least-privilege DB account and APP_SECRET_KEY via docker/php/provision.php;
  SMTP passwords re-encrypted with a random IV (secret_box.php)
- Socket.IO rooms from a PHP-signed token; /emit and cron refuse empty secrets
- escape notification text; CLI guards on build scripts; no fixed demo password

docker/php/apache-wms.conf

@@ -0,0 +1,22 @@
+# Apache hardening for the wms-app container.
+
+# No version banners in headers or error pages.
+ServerTokens Prod
+ServerSignature Off
+TraceEnable Off
+
+# The repository is mounted under the web root; its .htaccess refuses .git, .env,
+# deployment folders and app internals, so it must be honoured.
+<Directory /var/www/html/wms-app>
+    Options -Indexes +FollowSymLinks
+    AllowOverride All
+    Require all granted
+</Directory>
+
+# Nothing else under the default web root is part of this app.
+<Directory /var/www/html>
+    Options -Indexes
+</Directory>
+
+# FORCE_HTTPS from docker-compose is read by the .htaccess redirect rule.
+PassEnv FORCE_HTTPS