# Route everything through the front controller unless a real file exists.
<IfModule mod_rewrite.c>
    RewriteEngine On

    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^ index.php [L]
</IfModule>

# Basic hardening
Options -Indexes
ServerSignature Off

# ─── Security Headers (set via PHP bootstrap for flexibility) ──────
# Headers are set in app/bootstrap.php for better compatibility.
# This .htaccess handles file access control only.

# ─── Block sensitive files ─────────────────────────────────────────
<FilesMatch "\.(env|git|ini|log|sql)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order Allow,Deny
        Deny from all
    </IfModule>
</FilesMatch>
