Harden web root, secrets and realtime auth

- .htaccess: refuse .git, .env, docker, nodejs, sdlc*, scripts, archives and
  app internals; security headers, HSTS over TLS, optional HTTPS redirect
- uploads served through app/file.php to signed-in users only
- Apache/PHP hardening config for the container (ServerTokens, expose_php)
- least-privilege DB account and APP_SECRET_KEY via docker/php/provision.php;
  SMTP passwords re-encrypted with a random IV (secret_box.php)
- Socket.IO rooms from a PHP-signed token; /emit and cron refuse empty secrets
- escape notification text; CLI guards on build scripts; no fixed demo password

scripts/adjust_docx_whitespace.php

@@ -2,6 +2,12 @@
 
 declare(strict_types=1);
 
+// Build script, CLI only — the repository sits under the web root.
+if (PHP_SAPI !== 'cli') {
+    http_response_code(404);
+    exit;
+}
+
 if ($argc !== 2) {
     fwrite(STDERR, "Usage: php adjust_docx_whitespace.php <document.docx>\n");
     exit(2);

scripts/format_progress_status_html.php

@@ -1,6 +1,12 @@
 <?php
 declare(strict_types=1);
 
+// Build script, CLI only — the repository sits under the web root.
+if (PHP_SAPI !== 'cli') {
+    http_response_code(404);
+    exit;
+}
+
 /*
  * Applies the approved print layout from the first formatted Progress Status
  * Record to every generated Progress Status Record HTML file. Markdown source

scripts/generate_progress_status_records.php

@@ -2,6 +2,12 @@
 
 declare(strict_types=1);
 
+// Build script, CLI only — the repository sits under the web root.
+if (PHP_SAPI !== 'cli') {
+    http_response_code(404);
+    exit;
+}
+
 $directory = __DIR__ . '/../sdlc/1-PM Process (10 Work Product)/3.Progess Status Record';
 
 $records = [

scripts/generate_project_plan_docs.php

@@ -2,6 +2,12 @@
 
 declare(strict_types=1);
 
+// Build script, CLI only — the repository sits under the web root.
+if (PHP_SAPI !== 'cli') {
+    http_response_code(404);
+    exit;
+}
+
 $base = __DIR__ . '/../sdlc/1-PM Process (10 Work Product)/2.Project Plan/';
 $w = 'http://schemas.openxmlformats.org/wordprocessingml/2006/main';
 

scripts/generate_sow.php

@@ -2,6 +2,12 @@
 
 declare(strict_types=1);
 
+// Build script, CLI only — the repository sits under the web root.
+if (PHP_SAPI !== 'cli') {
+    http_response_code(404);
+    exit;
+}
+
 /**
  * Generate the ISO/IEC 29110 Statement of Work for BRN WMS.
  *

scripts/generate_work_schedule.php

@@ -2,6 +2,12 @@
 
 declare(strict_types=1);
 
+// Build script, CLI only — the repository sits under the web root.
+if (PHP_SAPI !== 'cli') {
+    http_response_code(404);
+    exit;
+}
+
 $output = __DIR__ . '/../sdlc/1-PM Process (10 Work Product)/2.Project Plan/1-Work Schedule/'
     . '200-WMS-26-001-00 Work Schedule 25690105 V1.0 Final.xlsx';
 

scripts/normalize_document_dates.php

@@ -2,6 +2,12 @@
 
 declare(strict_types=1);
 
+// Build script, CLI only — the repository sits under the web root.
+if (PHP_SAPI !== 'cli') {
+    http_response_code(404);
+    exit;
+}
+
 $root = __DIR__ . '/../sdlc';
 $english = [
     'January'=>'01','February'=>'02','March'=>'03','April'=>'04','May'=>'05','June'=>'06',