==========================================================
 FIX NOTES - namecheck.triforcebd.online (UID CHECK API)
==========================================================

[1] HTTP ERROR 500 on /admin.php  ==> FIXED (main bug)
    Cause: admin.php had a function named generateApiKey()
    but core/functions.php ALREADY defines generateApiKey().
    admin.php requires core/functions.php, so PHP threw:
      Fatal error: Cannot redeclare generateApiKey()
    That fatal error is what produced the HTTP 500 page.
    Fix: renamed it to generateAdminApiKey() and wrapped it in
    function_exists() so it can never clash again.

[2] "Index of /admin/" file listing was public ==> FIXED
    Cause: the .htaccess files (they start with a dot) were most
    likely NOT uploaded to the server, so "Options -Indexes" and
    DirectoryIndex never took effect.
    Fix: - .htaccess and admin/.htaccess rewritten/hardened
         - added admin/index.html which instantly redirects to
           /admin.php, so even WITHOUT .htaccess the listing is gone.
    IMPORTANT: turn ON "show hidden files" in your FTP / File
    Manager when uploading, otherwise .htaccess is skipped again.

[3] SECURITY: rmtopupcom_ffnamecheck.sql was downloadable
    from the browser (it contains the admin bcrypt password hash
    and all API keys).
    Fix: root .htaccess now blocks .sql/.zip/.bak/.log/.env/dot files.
    STRONGLY RECOMMENDED: delete the .sql file from public_html
    after you import it in phpMyAdmin.

[4] API BUG: blocked / inactive keys still worked
    api.php never checked the `status` column, so a key you
    blocked in the admin panel could still call the API.
    Fix: added an active-status check. Also the expiry check now
    compares by calendar day (a key expiring today still works
    the whole day, instead of dying at 00:00).
    Also the ?type= parameter is now case-insensitive (RS / rs).

[5] PHP 8 warning: client_login.php used $_POST['api_key']
    without a null check -> "Undefined array key" warning on an
    empty form post. Fixed with ?? ''.

[6] normalizeApiKey() now casts input to string (PHP 8.1+
    deprecation safety).

----------------------------------------------------------
 FILE CHECK - nothing is missing
----------------------------------------------------------
 index.php ............ home page              OK
 docs.php ............. api documentation      OK
 api.php .............. api endpoint           OK
 admin.php ............ ADMIN PANEL (login)    FIXED
 client_login.php ..... client login           OK
 client_dashboard.php . client dashboard       OK
 config/db.php ........ db connection          OK
 core/functions.php ... helpers                OK
 core/api_handler.php . source api curl        OK
 core/auth.php ........ legacy auth helper     OK (unused)
 core/header.php ...... public navbar          OK
 admin/*.php .......... old folder, redirects  OK
 admin/index.html ..... NEW anti-listing file  ADDED
 .htaccess ............ hardened               UPDATED
 admin/.htaccess ...... hardened               UPDATED
 assets/uploads/branding/ ... logo/favicon dir OK (chmod 755)

----------------------------------------------------------
 HOW TO UPLOAD
----------------------------------------------------------
 1. Upload every file/folder into public_html (overwrite).
 2. Enable "show hidden files" so .htaccess uploads too.
 3. Make sure assets/uploads/branding/ is writable (755).
 4. Delete rmtopupcom_ffnamecheck.sql from public_html.
 5. Open https://namecheck.triforcebd.online/admin.php
    Login: admin@gmail.com  (your existing password)

 If /admin.php still shows 500 after upload, it is a server-side
 issue, not a code issue - check cPanel > Errors, and confirm
 PHP version 8.0+ with PDO_MySQL and cURL enabled, and that
 config/db.php credentials match your real database.
