Codex's updates...

bin/cleanup-auth.php

@@ -0,0 +1,7 @@
+<?php
+if (PHP_SAPI !== 'cli') { http_response_code(404); exit; }
+require_once __DIR__ . '/../classes/Base.php';
+$db = (new Base())->connect();
+$db->exec('DELETE FROM password_resets WHERE expires_at < UTC_TIMESTAMP()');
+$db->exec('DELETE FROM auth_attempts WHERE window_started < DATE_SUB(UTC_TIMESTAMP(), INTERVAL 1 DAY)');
+echo "Expired authentication records removed.\n";

bin/dev-router.php

@@ -0,0 +1,15 @@
+<?php
+/** Router for the local PHP development server; not used by Apache/IIS. */
+if (PHP_SAPI !== 'cli-server') { http_response_code(404); exit; }
+$path = rawurldecode(parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH) ?: '/');
+if ($path === '/' || $path === '/main.php') {
+    require __DIR__ . '/../main.php';
+    return true;
+}
+if (preg_match('~\A/(css|js|images)/[A-Za-z0-9_./-]+\.(css|js|png|jpg|jpeg|gif|svg|ico|woff2?|ttf|map)\z~i', $path)) {
+    $file = realpath(__DIR__ . '/..' . $path);
+    $root = realpath(__DIR__ . '/..');
+    if ($file && str_starts_with($file, $root . DIRECTORY_SEPARATOR) && !str_contains($path, '..')) return false;
+}
+http_response_code(404);
+exit('Page not found.');

bin/migrate-auth.php

@@ -0,0 +1,26 @@
+<?php
+
+// Explicit CLI migration: never connect or alter tables during normal web requests.
+if (PHP_SAPI !== 'cli') {
+    http_response_code(404);
+    exit;
+}
+require_once __DIR__ . '/../classes/Base.php';
+$db = (new Base())->connect();
+$columns = $db->query('SHOW COLUMNS FROM users')->fetchAll(PDO::FETCH_COLUMN);
+foreach (['user_password_hash', 'user_first_name', 'user_last_name', 'user_status', 'user_last_login'] as $column) {
+    if (!in_array($column, $columns, true))
+        throw new RuntimeException("Missing users.{$column}. Align the database with tables/users.php before migrating; existing account data must be preserved.");
+}
+$sql = file_get_contents(__DIR__ . '/../migrations/001_auth.sql');
+if (in_array('user_auth_version', $columns, true)) {
+    $sql = str_replace('ALTER TABLE users ADD COLUMN user_auth_version INT UNSIGNED NOT NULL DEFAULT 0;', '', $sql);
+}
+foreach (explode(';', $sql) as $statement) {
+    if (trim($statement))
+        $db->exec($statement);
+}
+// Refresh the view so users.* includes the new session version column.
+require __DIR__ . '/../views/view_users.php';
+$db->exec(str_replace('create view', 'CREATE OR REPLACE VIEW', $SQL));
+echo "Authentication schema is ready.\n";