Откат пользовательской авторизации и миграционной системы ...

- Убран auth guard из EventsHandlers (API снова открыт)
- Удалены check_api_auth / api_auth_guard из App.php
- Удален Sessions.php и инстанцирование сессий
- Удалена миграционная система (Migration.php, MigrationsManager.php)
- Удалены файлы миграций create_sessions_table и fix_sessions_status
- Откачен console.php до прежнего состояния (убраны CLI migrate-команды)
- Удален тест AppAuthGuardTest.php
- Таблицы sessions и migrations дропнуты из БД

Пользовательский логин запланирован на потом; до тех пор API работает без Bearer/cookie auth.

Add migrations system for database schema management ...

- Create SHServ\Migrations\Migration base class with up()/down()
- Create MigrationsManager: tracks applied migrations in  table,
  supports migrate, rollback, status, and create commands
- Integrate with console.php: migrate, migrate:rollback, migrate:status,
  migrate:create
- Add first migration: create_sessions_table (needed for Session Entity)
- Use correct ThinBuilder field format for defaults and nullability

Phase 7: Separate ControlScripts from server core + CLI isolation + manifest ...

- Moved server/ControlScripts/ → automation/ in repo root.
  Updated composer.json autoload classmap (../automation/).
  Common.php keeps correct sync-map.json path via __DIR__.

- Removed RequiredControlScriptsScope; 'app:online' handler moved
  directly into EventsHandlers.php as core system behaviour.

- Replaced scandir() with scopes-manifest.json in App::control_scripts_init().
  New scopes require explicit manifest entry; no auto-discovery.

- Removed /api/v1/scripts/scopes/update route and scope_update() method.
  Remote scope editing via API is no longer available.

- Added ControlScripts::run_regular_script(alias) — unified entry point
  with state check and try/catch.

- CronController::run_regular_cron_scripts() now runs each script via
  CLI process (php console.php run-regular-script <alias>).
  Added 'run-regular-script' command to console.php.

- Updated tests:
  + CronControllerTest — verifies CLI dispatch and disabled skip.
  + ControlScriptsRegularTest — tests run_regular_script():
    missing alias, disabled state, exception catch, success path.

Server: 141 tests, 339 assertions — all pass.
Client: 167 tests — all pass.

Phase 1: Security Foundation (auth, SQLi, secrets, hashing, tokens, cookies)

Cleaning

init framework