ALLO AISSA — alloaissa.com
Deployment, in four steps.
================================================================================

1. UPLOAD
   Upload the CONTENTS of this archive (not the archive itself, and not a
   folder wrapping it) into the site's document root — the directory whose
   index.html the domain serves. When it is right, `index.html`, `.htaccess`,
   `robots.txt` and the `assets/` and `api/` folders sit side by side at the
   top of the document root.

   Make sure hidden files are transferred. `.htaccess` starts with a dot and
   many FTP clients hide it by default; without it the site still works, but
   HTTPS is not forced, the security headers are missing and the contact log
   directory is NOT closed to the public.

2. CREATE THE LOCAL CONFIG
   In `api/inc/`, copy `config.local.php.example` to `config.local.php` and
   edit it: the real mailbox, the real sender address, and a fresh secret.

   Generate the secret ON THE SERVER:
       php -r "echo bin2hex(random_bytes(32)), PHP_EOL;"

   `config.local.php` is not in this archive on purpose, so re-uploading the
   site later can never overwrite the live mailbox or the live secret.

3. THE LOG DIRECTORY
   `api/inc/data/` is created automatically the first time the form is used.
   PHP must be able to write to `api/inc/`. If it cannot, create `data/`
   by hand and give it mode 0700.

   Then check that it is closed to the public. In a browser, open:
       https://alloaissa.com/api/inc/data/contact.log
   It MUST return 403 or 404. If it shows a file, `.htaccess` did not upload —
   go back to step 1 before the form is used, because that file contains
   visitors' names and email addresses.

4. SEND ONE REAL MESSAGE
   Open https://alloaissa.com/contact/, fill the form, send it, and confirm the
   email arrives in the mailbox from step 2.

   This is the ONE thing that cannot be tested before deployment: PHP's mail()
   depends entirely on the host's mail configuration. Everything up to the
   mail() call is covered by the test suite; delivery itself is not.

   If it does not arrive: check the spam folder first, then confirm the 'from'
   address in config.local.php is a real mailbox on this domain. A 'from' that
   does not exist on the domain is the usual cause.

================================================================================
WHAT IS IN HERE

  index.html, 404.html         the pages, at their pretty URLs
  services/<name>/             one page per service, eight of them
  assets/css|js|fonts|img      everything the pages load — no external origin
  api/contact.php              the contact form endpoint
  api/inc/                     its configuration and hardening (not public)
  .htaccess                    HTTPS, canonical host, security headers, caching
  robots.txt, sitemap.xml      for search engines
  llms.txt                     a plain-text summary for AI assistants
  favicon.svg, icon-*.png      tab and home-screen icons

Every page is written twice — as `page/index.html` and as `page.html` — so the
pretty URLs resolve even on a host with no rewrite rules. That is deliberate
redundancy, not duplication to clean up.

================================================================================
UPDATING THE SITE LATER

Prices, services, zones and opening hours all live in `build/data/*.json` in the
project, not in the HTML. Change the JSON, rebuild, and every page, the tariff
table, the sitemap, the structured data and llms.txt follow. Do not hand-edit
the HTML in this archive: the next build overwrites it.
