ASWARCO - Security Hardening Phase 1
====================================

This update adds:
- Browser security response headers.
- Stronger, username-and-IP-aware login throttling.
- A maximum password input length to reduce abusive requests.
- Five-minute, single-use administrator verification codes.
- Exact binding between the session and the generated verification code.
- Automatic revocation of stale administrator device records.
- Protection against old device records falsely blocking administrator login.
- Real feature tests for security headers, codes, stale devices, and throttling.

Install from PowerShell inside C:\Users\User\Herd\aswarco:

$update = Get-ChildItem "C:\Users\User" -Filter "ASWARCO*Security*Phase*1*.zip" -File -Recurse -ErrorAction SilentlyContinue | Select-Object -First 1
$update.FullName
Expand-Archive -LiteralPath $update.FullName -DestinationPath "C:\Users\User\Herd\aswarco" -Force
php artisan optimize:clear
php artisan test

Do not change local .env to production values yet.

After all automated and manual tests succeed:

git add .env.example app\Http\Controllers\Admin\AdminAuthController.php app\Http\Controllers\Auth\CustomerAuthController.php app\Http\Middleware\SecurityHeaders.php app\Providers\AppServiceProvider.php bootstrap\app.php config\aswarco.php routes\web.php tests\Feature\Security INSTALL_SECURITY_HARDENING_PHASE_1.txt
git commit -m "Harden authentication sessions and security headers"