Fix 10 critical/high issues from Phase 6-7 audit ...

- Entity::select_from_db() throws on missing record (fatal error fix)
- Scripts::select_scripts_by_aliases_types() early return on empty array (SQL syntax fix)
- ThinBuilder WHERE operator whitelist (SQL injection prevention)
- validate_identifier() rejects numeric start (SQL correctness)
- Remove escape_string_in_arr() dead code (security hygiene)
- MetaManager::create_or_update() wrapped in transaction (race condition)
- Scripts::remove_scope() deletes DB before file (consistency)
- IN clause guards against non-array values (PHP 8 TypeError fix)
- Short where syntax supports IN operator (correctness)
- DeviceAuth::kill() clears Device auth cache (stale data fix)

Fix critical issues: router method enforcement, cron localhost guard, rate limiter file-based, entity update_at optional, device race condition, area remove transaction, control scripts static flush

Add medium-complexity PHPUnit tests: Area recursion, controller validation ...

- AreaRecursionTest (10 tests): recursive traversal, depth limit ≤10,
  remove() cascade, inner devices/scripts lookup, parent_area()
- AreasRESTAPIControllerValidationTest (10 tests): new_area, update_alias,
  remove_area, place_in_area, update_display_name validation
- DevicesRESTAPIControllerValidationTest (12 tests): setup_new_device,
  do_device_action, update_alias, devices_list, place_in_area validation
- ScriptsRESTAPIControllerValidationTest (10 tests): run_action_script,
  set_*_state, place_in_area validation
- Fix Controller::validate_positive_int_ids() return type: ?array → ?string
- Add DevTools to TestApp/bootstrap for Model instantiation
- Expand bootstrap.php text_msgs with controller error aliases
- Update server-audit.md coverage table: 80 tests, 202 assertions

Phase 5: Code quality and tech debt (side effects, dedup, dead code, config extraction, log security)

Phase 1: Security Foundation (auth, SQLi, secrets, hashing, tokens, cookies)

ControlScripts. Try fix

ControlScripts. Added Common.php

ControlScripts. Try fix

ControlScripts. Added Common.php

Actions

Meta system upd

Upd scope file endpoint

DeviceScriptsHelper && Scripts

Scripts in progress

Start ScriptRESTAPI

Regular control scripts

Better events api

Added First step events system

init framework