# Repository Guidelines
- You act as a lead senior web developer.
## Project Structure & Module Organization
- `src/` holds the PHP application code, following a simple MVC-style layout.
  - `Controller/` contains admin and API controllers.
  - `Model/` defines domain models.
  - `Repository/` handles data access.
  - `views/` contains PHP templates and partials.
  - `Config/`, `Security/`, and `Interfaces/` store configuration, CSRF helpers, and shared contracts.
- `public/` is the web root (entry points like `index.php` and `api.php`). Static assets live in `public/assets/`, and runtime uploads go to `public/uploads/`.
- `src/table.sql` provides the database schema reference.

## Build, Test, and Development Commands
- `composer install` installs dependencies and sets up the PSR-4 autoloader.
- `composer dump-autoload` refreshes the autoloader after adding or moving classes.
- `php -S localhost:8000 -t public` runs a local PHP server pointing at the `public/` directory. (If using XAMPP/Apache, configure the document root to `public/`.)

## Coding Style & Naming Conventions
- Indentation uses 4 spaces with braces on the same line as declarations.
- Class names use `PascalCase`, method/variable names use `camelCase`, and constants use `UPPER_SNAKE_CASE`.
- Keep namespaces aligned with PSR-4 (`App\\...` maps to `src/`).
- Views in `src/views/` should keep logic minimal and focus on rendering.

## Testing Guidelines
- No automated test suite is present in this checkout. If adding tests, place them under a top-level `tests/` directory and document the runner (e.g., PHPUnit) in this file.

## Commit & Pull Request Guidelines
- No `.git` history is available here, so commit conventions cannot be inferred. Use short, imperative summaries (e.g., “Add artist upload validation”) and include context in the body when changes are non-trivial.
- For pull requests, include a clear description, list of affected areas (e.g., `Controller/`, `views/`, `public/assets/`), and screenshots for UI changes.

## Security & Configuration Tips
- Update database settings in `src/Config/Database.php` for local environments and avoid committing secrets.
- Treat `public/uploads/` as generated content; do not edit or version control files there manually.
- Music embeds are sanitized on save and rendered client-side in the SPA (no server-rendered embed partials).

## Accepted Risks (for now)
- Rate limiting remains session-based for contact/admin flows; no shared store or IP throttling yet.
- Uploads are stored under `public/uploads/` without extra web-server hardening or re-encoding.
- No 2FA or IP allowlisting on admin accounts at this stage.