Harden web root, secrets and realtime auth

- .htaccess: refuse .git, .env, docker, nodejs, sdlc*, scripts, archives and
  app internals; security headers, HSTS over TLS, optional HTTPS redirect
- uploads served through app/file.php to signed-in users only
- Apache/PHP hardening config for the container (ServerTokens, expose_php)
- least-privilege DB account and APP_SECRET_KEY via docker/php/provision.php;
  SMTP passwords re-encrypted with a random IV (secret_box.php)
- Socket.IO rooms from a PHP-signed token; /emit and cron refuse empty secrets
- escape notification text; CLI guards on build scripts; no fixed demo password

nodejs/scheduler.js

@@ -8,6 +8,13 @@ const PHP_WEBROOT = process.env.PHP_WEBROOT  || '/brnwms/app';
 const SECRET      = process.env.EMIT_SECRET  || '';
 const NODE_PORT   = process.env.PORT         || 3000;
 
+if (!SECRET) {
+    // The PHP cron endpoints refuse an empty secret; fail loudly instead of
+    // sending unauthenticated calls every schedule tick.
+    console.error('EMIT_SECRET is not set — scheduler not started.');
+    process.exit(1);
+}
+
 function callPhp(path, body) {
     return new Promise((resolve, reject) => {
         const payload = JSON.stringify(body);