Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

- Stop starting a second Alpine instance in app.js; Livewire already ships and
  starts Alpine, so every x-on handler fired twice and toggles (user dropdown,
  logout menu) cancelled themselves out.
- Email verification links work on any device/browser (no longer require an
  existing session); the user is logged in after verifying.
- Add /dashboard role router; logged-in users hitting /login, /register or the
  landing page go to their dashboard instead of looping back to "Login".
- Case-insensitive email login/reset (mobile keyboards capitalise the first
  letter); emails and usernames are normalised to lowercase on signup.
- Accept local Egyptian (01xxxxxxxxx), 00-prefixed and spaced phone numbers.
- Role-based sidebar for every app page; new company sidebar replacing dead
  href="#" links; wire dashboard quick actions, bell, profile/settings menus.
- Guest header shows Login/Register (or Dashboard when signed in).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Tabs component: The <x-ui.tabs> was creating its own x-data Alpine scope
which shadowed the parent's activeTab state, preventing tab clicks from
toggling panel visibility. Now detects slot mode (ComponentSlot) and skips
emitting x-data, letting the parent scope handle state.

Sidebar: Profile edit and dashboard pages had hardcoded href="#" links for
Projects, Campaigns, Messages, Portfolio. Replaced with the shared
creator-sidebar include that uses real routes. Also fixed dropdown profile/
settings links in the main layout.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Mail: Use verify_peer=false for internal Docker SMTP (self-signed cert on
  srv-captain--mail). Without this, STARTTLS fails with certificate verify
  error and no emails are sent.
- Livewire: Add livewire:publish --assets to entrypoint.sh so the JS file
  is available after container restarts (assets live in public/ which isn't
  in a persistent volume).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

CapRover terminates SSL before forwarding to the container, so Laravel
needs to trust the X-Forwarded-* headers to generate https:// URLs in
redirects. Without this, all redirects pointed to http:// which then
triggered another redirect loop through CapRover's force-SSL setting.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

All auth controllers were always returning JSON responses via the ApiResponse
trait, even for standard HTML form submissions. Browser forms don't set
Accept: application/json, so they received raw JSON text instead of proper
redirects/error displays. Now all controllers check expectsJson() to serve
both web and API clients correctly.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

The tabs component receives tabs either as an array prop (for simple
label-based tabs) or as a named slot (for custom tab button HTML).
Now it handles both patterns without crashing on count().
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- campaigns: deadline -> application_deadline
- applications: creator_profile_id -> creator_id
- company_profiles: approval_status -> status
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Use IF NOT EXISTS checks to avoid duplicate index errors when
original table migrations already define the same indexes.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Install laravel/sanctum (fixes all 13 API route files that use auth:sanctum)
- Add HasApiTokens trait to User model
- Create missing sidebar partials (admin-sidebar, creator-sidebar) fixing 8 pages
- Add missing DB columns: last_active_at, reputation_tier (creator_profiles), admin_notes (projects)
- Fix ForceProjectStatusRequest validation to match DB CHECK constraint
- Fix Submission::revisionRequest() relationship type (belongsTo -> hasOne)
- Add eager-load for company+creator in project show controllers
- Create missing InvitationCancelled event class
- Add missing translation keys (en+ar) for sidebar navigation
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Registration no longer crashes if email verification fails to send.
Also fix mail host: srv-captain--poste-io -> srv-captain--mail.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Rename portfolio_items migration to run before application_portfolio_items pivot
- Fix materialized view referencing cp.niches (should be cp.content_niches) and remove nonexistent last_active_at column
- Make entrypoint non-fatal on migration failure with DB wait loop
- Health endpoint always returns 200 (degraded status in body) to prevent Docker killing healthy containers
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

symfony/translation in the lock file requires PHP >= 8.4.1, causing
container crash on startup with the 8.3 image.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Covers Auth (registration, login, email verification, password reset, username validation),
Admin (user management, company approval, impersonation, audit log, dashboard stats),
Companies (profile CRUD, social link normalization, completion scoring, approval flow),
Creators (profile CRUD, username throttle, completion scoring, scopes, policies),
and Settings (platform settings CRUD, caching, CSS generation, feature flags).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>