Initial import of fitme3070.pt platform

Plain-PHP fleet platform with id.andmore.pt SSO. Wires shared/platform-tools
as a submodule (platform_update, backups, git/migration tools) like the other
platforms.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

config/env.php

@@ -0,0 +1,56 @@
+<?php
+// ─── .env loader + env() helper ──────────────────────────────────────────────
+//
+// Lightweight, dependency-free reader for KEY=value files. Loaded by
+// config/db.php BEFORE any other include so credentials and APP_ENV are
+// available everywhere. Real environment variables (PHP-FPM pool, Apache
+// SetEnv, shell exports) win over .env values — never overwritten.
+//
+// Format: one KEY=value per line, # for comments, optional surrounding quotes.
+
+function env_load(string $path): void {
+    if (!is_file($path)) return;
+    // No is_readable() pre-check: it returns false negatives on Windows
+    // network mounts. Attempt the read and report only a real failure.
+    $lines = @file($path, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
+    if ($lines === false) {
+        error_log("env_load: .env file exists at {$path} but could not be read by the PHP process. Fix with: chmod 640 {$path}");
+        return;
+    }
+    foreach ($lines as $line) {
+        $line = trim($line);
+        if ($line === '' || $line[0] === '#') continue;
+        if (strpos($line, '=') === false) continue;
+        [$k, $v] = array_pad(explode('=', $line, 2), 2, '');
+        $k = trim($k);
+        if ($k === '') continue;
+        // Strip inline comments only when value isn't quoted.
+        $v = trim($v);
+        if ($v !== '' && $v[0] !== '"' && $v[0] !== "'") {
+            $hash = strpos($v, ' #');
+            if ($hash !== false) $v = rtrim(substr($v, 0, $hash));
+        }
+        $v = trim($v, " \"'");
+        // Don't overwrite real environment variables — they take precedence.
+        if (getenv($k) === false) {
+            putenv("$k=$v");
+            $_ENV[$k] = $v;
+        }
+    }
+}
+
+function env(string $key, $default = null) {
+    $v = getenv($key);
+    return $v === false ? $default : $v;
+}
+
+// True when the current request is HTTPS — including when TLS terminates at a
+// reverse proxy. Behind a proxy you MUST set TRUSTED_PROXY=true in .env or the
+// X-Forwarded-Proto header is ignored (otherwise any client could spoof it).
+function request_is_https(): bool {
+    if (!empty($_SERVER['HTTPS']) && strtolower($_SERVER['HTTPS']) !== 'off') return true;
+    if (($_SERVER['SERVER_PORT'] ?? '') === '443') return true;
+    $trusted = filter_var(env('TRUSTED_PROXY', 'false'), FILTER_VALIDATE_BOOLEAN);
+    if ($trusted && strtolower($_SERVER['HTTP_X_FORWARDED_PROTO'] ?? '') === 'https') return true;
+    return false;
+}