Initial import of fitme3070.pt platform

Plain-PHP fleet platform with id.andmore.pt SSO. Wires shared/platform-tools
as a submodule (platform_update, backups, git/migration tools) like the other
platforms.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

config/config.php

@@ -0,0 +1,63 @@
+<?php
+// ─────────────────────────────────────────────────────────────────────────────
+// Static, secret-bearing configuration. Operational settings (APP_NAME, base
+// URL, email-from headers, reminder_hours, Nextcloud URL/token, logo filenames)
+// live in the `system_settings` table — see config/functions_settings.php and
+// views/sysadmin/system_settings.php. Only credentials and tokens stay here so
+// DB dumps never expose them.
+//
+// Values come from the .env file (loaded by config/db.php via config/env.php
+// before this file runs). The fallback in each env() call keeps the platform
+// running if .env is missing — never put real production secrets as defaults.
+// ─────────────────────────────────────────────────────────────────────────────
+
+// ─── Environment ──────────────────────────────────────────────────────────────
+define('APP_ENV',            env('APP_ENV', 'prod'));
+// Email/SMS delivery — including the dev redirect/print safety net — now lives at
+// id.andmore.pt (/notify). See config/functions_notify_client.php. NOTIFY_API_KEY
+// (in .env) authenticates this app to the central service.
+
+if (APP_ENV !== 'prod') {
+    ini_set('display_errors', '1');
+    ini_set('display_startup_errors', '1');
+    error_reporting(E_ALL);
+} else {
+    ini_set('display_errors', '0');
+    error_reporting(E_ALL);   // still catch everything, just don't echo it
+}
+
+require_once __DIR__ . '/error_handler.php';
+
+// ─── Identity / Andmore ID ────────────────────────────────────────────────────
+// IDENTITY_MODE: 'standalone' (default) or 'federated'. In federated mode every
+// register/login syncs the user to the central andmore_id DB so users.andmore_id
+// is always populated and cross-platform relationships work by canonical id.
+define('IDENTITY_MODE', strtolower(env('IDENTITY_MODE', 'standalone')) === 'federated' ? 'federated' : 'standalone');
+
+// Slug identifying this install on andmore_id.linked_platforms. Used to scope
+// link tokens and resolve the satellite's display name on the central verify page.
+define('PLATFORM_SLUG', (string) env('PLATFORM_SLUG', 'fitme3070'));
+
+define('ANDMORE_ID_URL',  rtrim(env('ANDMORE_ID_URL', 'https://id.andmore.pt'), '/') . '/');
+
+// Parent domain the am_sso cookie is scoped to (e.g. .andmore.pt). Empty in
+// standalone mode — federated mode requires a non-empty value.
+define('SSO_COOKIE_DOMAIN',    (string) env('SSO_COOKIE_DOMAIN', ''));
+// Cookie name. Override per environment when prod and dev share a parent
+// domain (e.g. SSO_COOKIE_NAME=am_sso_dev in dev) so the prod cookie on
+// .andmore.pt doesn't clobber the dev session and vice versa.
+define('SSO_COOKIE_NAME',      (string) env('SSO_COOKIE_NAME', 'am_sso'));
+define('SSO_SESSION_TTL_DAYS', (int)    env('SSO_SESSION_TTL_DAYS', 30));
+
+// When true (federated mode only): local login/register pages redirect to
+// Andmore ID; require_login() sends unauthenticated users directly there.
+define('SSO_REQUIRED',    filter_var(env('SSO_REQUIRED', 'false'), FILTER_VALIDATE_BOOLEAN));
+
+// When true (federated mode only): a register/login attempt fails with a clear
+// error if the central DB is unreachable, instead of silently falling through
+// and creating an orphan local row. Standalone mode ignores this.
+define('IDENTITY_REQUIRE_UPSTREAM', filter_var(env('IDENTITY_REQUIRE_UPSTREAM', 'false'), FILTER_VALIDATE_BOOLEAN));
+
+function identity_is_federated(): bool { return IDENTITY_MODE === 'federated'; }
+function identity_is_standalone(): bool { return IDENTITY_MODE === 'standalone'; }
+function identity_require_upstream(): bool { return identity_is_federated() && IDENTITY_REQUIRE_UPSTREAM; }