Initial import of fitme3070.pt platform

Plain-PHP fleet platform with id.andmore.pt SSO. Wires shared/platform-tools
as a submodule (platform_update, backups, git/migration tools) like the other
platforms.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

config/functions_db.php

@@ -0,0 +1,49 @@
+<?php
+// ─── Generic DB helpers ──────────────────────────────────────────────────────
+// Per the fleet convention, page files never write raw SQL — they call helpers
+// here (and in feature-specific config/functions_*.php files added later). This
+// pass ships only the user/auth-adjacent helpers needed by the SSO shell and
+// the admin/user dashboards; domain CRUD (plataforma_fitness, team, modalidades,
+// horário, galerias) lands with the follow-up port.
+
+// Fetch a single user row by id (NULL if missing).
+function db_get_user(PDO $pdo, int $id): ?array {
+    $stmt = $pdo->prepare("SELECT * FROM users WHERE id = ? LIMIT 1");
+    $stmt->execute([$id]);
+    return $stmt->fetch(PDO::FETCH_ASSOC) ?: null;
+}
+
+// Fetch a single user row by email (canonical SSO key).
+function db_get_user_by_email(PDO $pdo, string $email): ?array {
+    $stmt = $pdo->prepare("SELECT * FROM users WHERE email = ? LIMIT 1");
+    $stmt->execute([strtolower(trim($email))]);
+    return $stmt->fetch(PDO::FETCH_ASSOC) ?: null;
+}
+
+// All backoffice users (sysadmin + admin + staff) for management lists.
+function db_get_all_staff(PDO $pdo): array {
+    return $pdo->query(
+        "SELECT * FROM users
+         WHERE role IN ('sysadmin','admin','staff')
+         ORDER BY FIELD(role,'sysadmin','admin','staff'), name"
+    )->fetchAll(PDO::FETCH_ASSOC);
+}
+
+// Active admins (sysadmin + admin) — e.g. assignment dropdowns.
+function db_get_active_admins(PDO $pdo): array {
+    return $pdo->query(
+        "SELECT * FROM users
+         WHERE role IN ('sysadmin','admin') AND is_active = 1
+         ORDER BY name"
+    )->fetchAll(PDO::FETCH_ASSOC);
+}
+
+// PT-PT label for the role ladder.
+function role_label(string $role): string {
+    return [
+        'sysadmin' => 'Administrador de sistema',
+        'admin'    => 'Administrador',
+        'staff'    => 'Equipa',
+        'client'   => 'Cliente',
+    ][$role] ?? ucfirst($role);
+}