DIR//LISTER v26.0911 — CHECKLIST UPLOAD public_html
==================================================

A. FILE WAJIB DI public_html (folder yang sama)
   index.php
   index.js
   index.css
   dl_webauthn.php
   .env                 (bukan env tanpa titik — salin dari env.example)
   .htaccess            (dari file htaccess)
   VERSION              (opsional)

B. JANGAN UPLOAD KE PUBLIC (atau pastikan ter-deny)
   env (tanpa titik) — hanya template lokal
   audit.log sample
   dirlister_auth.php dari mesin dev (biarkan server yang punya)
   README / RELEASE-NOTES boleh, tidak wajib

C. SETELAH UPLOAD
   1) Rename: env.example → .env  (atau upload .env yang sudah diisi)
   2) chmod 600 .env
   3) chmod 600 .dirlister_auth.php .dirlister_ket.php .audit.log  (jika ada)
   4) Pastikan folder writable untuk .trash, auth, ket, audit
   5) Edit .env:
        SITE=domain-anda.com
        HOME_URL=https://domain-anda.com/
        APPVER=v26.0911
        LOCKED_FOLDERS=~SRVTKJ-DC
        LOCKED_PASSWORD=password-kuat-bukan-placeholder
   6) HTTPS wajib untuk WebAuthn/Passkey
   7) Self-test: https://domain-anda.com/index.php?selftest=1
      (butuh session admin atau token)

D. UJI FUNGSI
   [ ] Listing root terbuka
   [ ] Login password OK
   [ ] Daftar passkey (admin) OK
   [ ] Login passkey OK
   [ ] Buka folder ~SRVTKJ-DC minta password
   [ ] Mobile tampilan LIST
   [ ] CSS/JS termuat (?v=... cache bust)

E. HARDENING HOSTING
   [ ] PHP 7.4+ (disarankan 8.x)
   [ ] display_errors=Off (php.ini / panel hosting)
   [ ] OpenSSL enabled (passkey)
   [ ] fileinfo / gd opsional (MIME + WebP)
   [ ] Jangan expose .env — .htaccess sudah deny
   [ ] Folder ~SRVTKJ-DC: pertimbangkan deny akses langsung di Apache/Nginx
     jika file di dalamnya sangat sensitif

F. CATATAN
   - Nama file di server: .htaccess (titik di depan), .env (titik di depan)
   - dl_webauthn.php harus ada, tapi diblok akses langsung via .htaccess
   - Passkey hanya ES256 (Windows Hello / platform authenticator)