5 Commits

Include renames

Author	SHA1	Message	Date
Thanakorn	8705be0d1b	Enforce roles on admin endpoints and return real status codes ... - users, SMTP and batch-lock endpoints are owner/admin only - engines answer 400/403/404/409/500 instead of 200 with an error body; database errors no longer leak to the client	2026-09-24 14:53:40 +07:00
Thanakorn	e579dd596c	Start every session through session.php; idle timeout, app access and auth status codes	2026-09-24 14:30:35 +07:00
Thanakorn S	5ca6b49fd0	code audit fixes: require_once, issue flow, role guards	2026-05-23 17:06:08 +07:00
Thanakorn S	7396db6ffc	accounting workflows	2026-05-20 10:17:02 +07:00
Thanakorn S	04a683bd02	accounting modules	2026-05-13 15:11:24 +07:00