Откат пользовательской авторизации и миграционной системы ...

- Убран auth guard из EventsHandlers (API снова открыт)
- Удалены check_api_auth / api_auth_guard из App.php
- Удален Sessions.php и инстанцирование сессий
- Удалена миграционная система (Migration.php, MigrationsManager.php)
- Удалены файлы миграций create_sessions_table и fix_sessions_status
- Откачен console.php до прежнего состояния (убраны CLI migrate-команды)
- Удален тест AppAuthGuardTest.php
- Таблицы sessions и migrations дропнуты из БД

Пользовательский логин запланирован на потом; до тех пор API работает без Bearer/cookie auth.

Phase 7: Separate ControlScripts from server core + CLI isolation + manifest ...

- Moved server/ControlScripts/ → automation/ in repo root.
  Updated composer.json autoload classmap (../automation/).
  Common.php keeps correct sync-map.json path via __DIR__.

- Removed RequiredControlScriptsScope; 'app:online' handler moved
  directly into EventsHandlers.php as core system behaviour.

- Replaced scandir() with scopes-manifest.json in App::control_scripts_init().
  New scopes require explicit manifest entry; no auto-discovery.

- Removed /api/v1/scripts/scopes/update route and scope_update() method.
  Remote scope editing via API is no longer available.

- Added ControlScripts::run_regular_script(alias) — unified entry point
  with state check and try/catch.

- CronController::run_regular_cron_scripts() now runs each script via
  CLI process (php console.php run-regular-script <alias>).
  Added 'run-regular-script' command to console.php.

- Updated tests:
  + CronControllerTest — verifies CLI dispatch and disabled skip.
  + ControlScriptsRegularTest — tests run_regular_script():
    missing alias, disabled state, exception catch, success path.

Server: 141 tests, 339 assertions — all pass.
Client: 167 tests — all pass.

Fix Model layer & API robustness batch (7 items) ...

- Entity::update() now checks rowCount; returns false when no rows affected.
- Entity::update() preserves modified_fields on PDOException (try/catch).
- Device::set_device_token() caches auth() call instead of 3 repeated invocations.
- User::__construct() removed eager profile query; profile() now lazy-loads via get_pet_instance().
- alias_is_uniq() in Areas and Devices models accepts optional exclude_id to skip self on update.
- Controllers updated to pass entity id to alias_is_uniq() so updating alias to current value succeeds.
- CronController::run_regular_cron_scripts() wraps each script in try/catch; logs failure and continues.
- App::api_auth_guard() replaced exit() with return false; EventsHandlers stops routing on auth rejection.
- Tests added: EntityCrud (missing-record + preserved-fields), UserEntity (lazy-loading),
  CronController (failure-continuation), AppAuthGuard (structured 401 output),
  Areas/Devices validation (same-alias update allowed).
- Test bootstrap: added logs_enable/logs_folder to FCONF to suppress PHP warnings in Cron tests.

All 136 server tests pass, 334 assertions.
All 167 Vue client tests pass.

Phase 1: Security Foundation (auth, SQLi, secrets, hashing, tokens, cookies)

DeviceScanner

init framework