CapRover terminates SSL before forwarding to the container, so Laravel
needs to trust the X-Forwarded-* headers to generate https:// URLs in
redirects. Without this, all redirects pointed to http:// which then
triggered another redirect loop through CapRover's force-SSL setting.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

All auth controllers were always returning JSON responses via the ApiResponse
trait, even for standard HTML form submissions. Browser forms don't set
Accept: application/json, so they received raw JSON text instead of proper
redirects/error displays. Now all controllers check expectsJson() to serve
both web and API clients correctly.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

The tabs component receives tabs either as an array prop (for simple
label-based tabs) or as a named slot (for custom tab button HTML).
Now it handles both patterns without crashing on count().
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- campaigns: deadline -> application_deadline
- applications: creator_profile_id -> creator_id
- company_profiles: approval_status -> status
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Use IF NOT EXISTS checks to avoid duplicate index errors when
original table migrations already define the same indexes.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Install laravel/sanctum (fixes all 13 API route files that use auth:sanctum)
- Add HasApiTokens trait to User model
- Create missing sidebar partials (admin-sidebar, creator-sidebar) fixing 8 pages
- Add missing DB columns: last_active_at, reputation_tier (creator_profiles), admin_notes (projects)
- Fix ForceProjectStatusRequest validation to match DB CHECK constraint
- Fix Submission::revisionRequest() relationship type (belongsTo -> hasOne)
- Add eager-load for company+creator in project show controllers
- Create missing InvitationCancelled event class
- Add missing translation keys (en+ar) for sidebar navigation
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Registration no longer crashes if email verification fails to send.
Also fix mail host: srv-captain--poste-io -> srv-captain--mail.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Rename portfolio_items migration to run before application_portfolio_items pivot
- Fix materialized view referencing cp.niches (should be cp.content_niches) and remove nonexistent last_active_at column
- Make entrypoint non-fatal on migration failure with DB wait loop
- Health endpoint always returns 200 (degraded status in body) to prevent Docker killing healthy containers
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

symfony/translation in the lock file requires PHP >= 8.4.1, causing
container crash on startup with the 8.3 image.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Covers Auth (registration, login, email verification, password reset, username validation),
Admin (user management, company approval, impersonation, audit log, dashboard stats),
Companies (profile CRUD, social link normalization, completion scoring, approval flow),
Creators (profile CRUD, username throttle, completion scoring, scopes, policies),
and Settings (platform settings CRUD, caching, CSS generation, feature flags).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>