[FIX] Uge session of debugging and code coverage.

api/router.php

@@ -1,48 +1,6 @@
 <?php
 
-// Load environment variables from .env file
-$envFile = __DIR__ . '/.env';
-if (file_exists($envFile)) {
-    $lines = file($envFile, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
-    foreach ($lines as $line) {
-        if (strpos($line, '#') === 0) continue;
-        if (strpos($line, '=') === false) continue;
-        list($key, $value) = explode('=', $line, 2);
-        $key = trim($key);
-        $value = trim($value);
-        if (!empty($key)) {
-            putenv("$key=$value");
-            $_ENV[$key] = $value;
-        }
-    }
-}
-
-// CORS headers - MUST be sent before any other output
-$allowedOrigins = ['http://localhost:5173', 'http://localhost:3000', 'http://localhost:4173', 'https://ohmj2.free.fr', 'https://partitions.c.nadal-fr.com', 'https://ohmj-api.c.nadal-fr.com'];
-$origin = $_SERVER['HTTP_ORIGIN'] ?? '';
-
-if (in_array($origin, $allowedOrigins)) {
-    header("Access-Control-Allow-Origin: $origin");
-    header('Access-Control-Allow-Credentials: true');
-} else {
-    header("Access-Control-Allow-Origin: *");
-}
-header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS');
-header('Access-Control-Allow-Headers: Authorization, Content-Type');
-
-// Handle OPTIONS preflight immediately
-if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
-    http_response_code(200);
-    exit;
-}
-
-// Router script for PHP built-in server
-$uri = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);
-
-// Serve existing files directly
-if ($uri !== '/' && file_exists(__DIR__ . $uri)) {
-    return false;
-}
-
-// Route everything through index.php
+// Dev server router: every request goes through index.php (environment
+// loading, CORS and OPTIONS handling all live there). No file is ever served
+// statically, so .env, config/users.json and composer.phar stay unreachable.
 require __DIR__ . '/index.php';