Refactor admin pages to use shared head and navigation components

- Created `admin-head.php` for consistent <head> markup across admin pages.
- Created `admin-nav.php` for shared navigation bar, reducing duplication.
- Updated all admin pages (account, hours, index, login, menu, users) to utilize the new components.
- Added security headers to `auth.php` and `index.php` for improved security.
- Introduced `security-headers.php` to manage security headers across the application.
- Moved inline styles from admin pages to SCSS files to comply with Content Security Policy (CSP).
- Normalized file permissions during build process to prevent permission issues on deployment.

docker-compose.yaml

@@ -1,52 +1,58 @@
+# The Old Fitz — production compose for the VPS.
+#
+# Expected layout, one folder per site:
+#   theoldfitz/
+#     docker-compose.yaml   (this file)
+#     .env                  (optional, see PROXY_NETWORK below)
+#     www/                  (contents of `npm run dist`)
+#     data/                 (fitz.sqlite — never inside www/)
+#
+# First run: create data/ and `chown 33:33 data` (www-data in the image),
+# then create the first admin with bin/create-user.php (see its header).
+#
+# The CasaOS dev host keeps its own copy of this file in the CasaOS app
+# settings, with CasaOS paths and its x-casaos block.
+
 name: the-old-fitz
 
 networks:
-  nginxproxymanager:
-    name: nginxproxymanager
+  proxy:
     external: true
+    # The reverse proxy's Docker network (NPM or Caddy). Set PROXY_NETWORK
+    # in .env if it isn't called "proxy".
+    name: ${PROXY_NETWORK:-proxy}
 
 services:
-  php-server:
+  the-old-fitz:
     image: php:8.5-apache
     container_name: the-old-fitz
     restart: unless-stopped
+    # The image ships without a php.ini, so PHP falls back to dev-style
+    # defaults and shows errors (with server paths) to visitors. Activate
+    # the image's bundled production ini — display_errors off, errors to
+    # the log — and hide the PHP version header, then start Apache as usual.
+    # Paths are spelled out (the image's $PHP_INI_DIR) rather than using
+    # the variable, so no $-escaping is needed.
+    command:
+      - bash
+      - -c
+      - cp /usr/local/etc/php/php.ini-production /usr/local/etc/php/php.ini && echo 'expose_php = Off' > /usr/local/etc/php/conf.d/zz-hardening.ini && exec apache2-foreground
     networks:
-      - nginxproxymanager
+      - proxy
     volumes:
       - type: bind
-        source: /DATA/AppData/theoldfitz/www
+        source: ./www
         target: /var/www/html
       # Database lives outside the web root so Apache can't serve it.
-      # FITZ_DATA_DIR defaults to the CasaOS dev host's path; set it in a
-      # .env file next to this compose file on the VPS.
       - type: bind
-        source: ${FITZ_DATA_DIR:-/DATA/AppData/theoldfitz/data}
+        source: ./data
         target: /var/www/data
     environment:
       - TZ=America/Indiana/Indianapolis
       - FITZ_DB_PATH=/var/www/data/fitz.sqlite
-    labels:
-      icon: https://www.php.net/images/logos/php-logo.svg
-
-x-casaos:
-  architectures:
-    - amd64
-    - arm64
-  author: self
-  category: Developer
-  description:
-    en_us: PHP web server running Apache, proxied through Nginx Proxy Manager.
-  developer: PHP
-  hostname: theoldfitz.daviddyer.me
-  icon: https://www.php.net/images/logos/php-logo.svg
-  id: self.php-server
-  index: /
-  is_uncontrolled: false
-  main: php-server
-  port_map: "80"
-  scheme: http
-  tagline:
-    en_us: PHP 8.5 + Apache web server.
-  thumbnail: https://www.php.net/images/logos/php-logo.svg
-  title:
-    en_us: PHP Server
+    # Cap container logs so PHP's error log can't slowly fill the disk.
+    logging:
+      driver: json-file
+      options:
+        max-size: 10m
+        max-file: "3"