# ── Mobile API — CORS & Security ─────────────────────────────────────
# Allow Android app to call these endpoints

# CORS headers for all responses
<IfModule mod_headers.c>
    Header always set Access-Control-Allow-Origin "*"
    Header always set Access-Control-Allow-Methods "GET, POST, OPTIONS"
    Header always set Access-Control-Allow-Headers "Authorization, Content-Type, X-Requested-With"
    Header always set Access-Control-Max-Age "86400"
</IfModule>

# Handle preflight OPTIONS requests
RewriteEngine On
RewriteCond %{REQUEST_METHOD} OPTIONS
RewriteRule ^(.*)$ $1 [R=200,L]

# Deny directory listing
Options -Indexes

# Force JSON content type for PHP files
<FilesMatch "\.php$">
    <IfModule mod_headers.c>
        Header set Content-Type "application/json; charset=UTF-8"
    </IfModule>
</FilesMatch>
