История коммитов

Comments pointed at .claude/http-kernel-migration-plan.md and its stage numbers, which
say nothing once the plan is gone. Rewritten to describe the code itself: "a worker
runtime" instead of "stage 6", "until the request scope is explicit" instead of
"until stage 5".

The session facade now wraps Symfony\Component\HttpFoundation\Session instead of
reading and writing the root of $_SESSION. Session data of existing installs stops
being readable, so every visitor is logged out once — noted in CHANGELOG.md together
with the loss of dot notation in the facade API.

- SessionFactory picks the storage by runtime: native under HTTP, in-memory under
CONSOLE_MODE, so cron runs and console commands no longer open a real PHP session
and leave sess_* files behind. The service is registered explicitly in
system/config/services.php instead of being autowired from a default argument.
- The session is started explicitly in the web bootstrap, before anything reads a key:
a read starts it implicitly, and the translator factory reads 'lng' during boot.
Kernel::handle() keeps an idempotent start() as the per-request entry point.
- Csrf keeps its tokens in one nested array: the facade stores flat keys.
- Session::invalidate() added and used on logout — clear() kept the old session id valid.
- Tests drive the session through its API on in-memory storage.

Replace remaining direct \ usage in modules with Johncms\Http\Session so data access stays unified before the 4b backend swap.

This avoids split storage risk during SessionInterface migration and updates the HTTP kernel migration plan to reflect 4a completion.

3 files: SettingsController ($_SESSION['lng'] → set(), set_ok/reset_ok → flash()), EditProfileController (success_message → flash()), RestorePasswordController ($_SESSION['code'] → set/remove).

IndexController.php and DownloadCategoryController.php: $_SESSION['sort_down'] / $_SESSION['sort_down2'] → $this->session->get(..., 0) / $this->session->set(), lazy init via default argument dropped.

Collections (4 admin controllers): $_SESSION['success_message'] → $this->session->flash()/getFlash(), removed pullFlash() helper.

System (4 files):
- Comments.php: $_SESSION['code'] → $this->session->set/get, fixed $owner type (bool→int) for isBlockedBy()
- TranslatorServiceFactory.php: $_SESSION['lng'] → $session->set/get/has, injected via $container
- Validator/Rules/Captcha.php: $_SESSION[$this->sessionField] → $session->has/get via di()
- Security/Csrf.php: $_SESSION['_csrf'][$token_id] → $this->session->set/get, constructor injection

- 14 admin controllers now inject Johncms\Http\Session\n- Use session->flash()/getFlash() for success messages\n- All files are final readonly classes with constructor injection

- Inject Johncms\Http\Session into AdminController, AdminSectionController, AdminArticleController, Article

- Use flash()/getFlash() for success messages, set()/get() for delete_token and view tracking

- Remove redundant $services->set(Article::class) that lacked autowire

- Make Article final readonly with promoted constructor properties

Composer's autoloader already enforces the PHP version requirement via platform config, making this check redundant.

Per-module notes for the 2c sweep, the 2d decision to keep compression in the
web server, and the 3b session/send() reasoning. Also records what was left
deliberately (BanIP, both UserFactory::userUnset(), the path-less cookie in
ChangePasswordController) and which stage picks it up.