# Phase 1 implementation

## Scope

This phase establishes the custom modular-monolith runtime, configuration, security baseline, MySQL schema lifecycle, server-rendered admin shell, and permanently locking browser installer. Airline operational modules are intentionally not included.

## Architecture

- `app/Core`: framework-free HTTP, persistence, validation, security, support, and migration primitives.
- `app/Modules`: module-owned controllers and future business capabilities.
- `app/Shared`: reusable cross-module domain code.
- `resources/views`: escaped server-rendered layouts, pages, errors, and UI components.
- `public`: the only web-accessible root.
- `database`: ordered migrations and idempotent seeders.

All database access uses PDO with emulated prepares disabled. Future repositories must use prepared statements and include `airline_id` on operational business tables.