IMPORTANT BEFORE DEPLOYMENT
1. Rotate the old database password, Firebase service-account key, payment token and SMS API key.
2. Put NEW values in config/config.php or hosting environment variables.
3. Never upload old account.json/private keys to a public web folder.
4. Use HTTPS only and enable Cloudflare/WAF/rate limiting at the hosting/CDN layer.
