Harden web root, secrets and realtime auth

- .htaccess: refuse .git, .env, docker, nodejs, sdlc*, scripts, archives and
  app internals; security headers, HSTS over TLS, optional HTTPS redirect
- uploads served through app/file.php to signed-in users only
- Apache/PHP hardening config for the container (ServerTokens, expose_php)
- least-privilege DB account and APP_SECRET_KEY via docker/php/provision.php;
  SMTP passwords re-encrypted with a random IV (secret_box.php)
- Socket.IO rooms from a PHP-signed token; /emit and cron refuse empty secrets
- escape notification text; CLI guards on build scripts; no fixed demo password

docker-compose.yml

@@ -23,6 +23,11 @@ services:
       SMTP_USERNAME: ${SMTP_USERNAME}
       SMTP_PASSWORD: ${SMTP_PASSWORD}
       OTP_REQUIRED: ${OTP_REQUIRED:-false}
+      DB_APP_USER: ${DB_APP_USER:-wms_app}
+      DB_APP_PASSWORD: ${DB_APP_PASSWORD:-}
+      APP_SECRET_KEY: ${APP_SECRET_KEY:-}
+      # true once TLS is in place (directly or via a proxy): HTTP is redirected to HTTPS.
+      FORCE_HTTPS: ${FORCE_HTTPS:-false}
     volumes:
       - .:/var/www/html/wms-app
     ports: