Diagnostic Info

<IfModule mod_rewrite.c>
    Options -MultiViews
    RewriteEngine On
    RewriteBase /

    # Redirect /api/... to api.php
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^api/(.*)$ api.php [L,QSA]

    # Redirect /pay/TOKEN to pay.php?token=TOKEN
    RewriteRule ^pay/([a-zA-Z0-9-_]+)$ pay.php?token=$1 [L,QSA]

    # All other non-existent files to index.php (404/fallback)
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^(.*)$ index.php [L,QSA]
</IfModule>

# Security Headers (Apache)
<IfModule mod_headers.c>
    Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "DENY"
    Header set Content-Security-Policy "default-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; script-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com; img-src 'self' data:; font-src 'self' https://fonts.gstatic.com;"
    Header set Referrer-Policy "no-referrer"
    Header set Permissions-Policy "geolocation=(), microphone=(), camera=()"
</IfModule>

# Deny access to sensitive files that shouldn't be in public but just in case
<FilesMatch "^\.env|database\.php|app\.php|\.sql|\.log$">
    Require all denied
</FilesMatch>