История коммитов

Move IP ban CRUD to IpBanController (rights>=9 super-group) under REST routes
/admin/ip-bans (list/new/prepare/store/search/clear/detail/delete). Add BanIp
model, IpBanType enum, IpBanRepositoryInterface (conflict/by-ip/CRUD), and use
cases PrepareIpBan (reuses IpRangeParser; checks conflicts and the admin's own
IP), StoreIpBan, GetIpBanList, ManageIpBan. Convert the ?mod= GET mutations to
POST forms with CSRF and store reason/url raw (escape on output). Remove
includes/ipban.php and the dispatcher entry; point both sidebars at /admin/ip-bans.

Move amnesty to AmnestyController (rights>=9 super-group): GET form + POST apply
at /admin/bans/amnesty. BanAmnestyRepositoryInterface (Eloquent Ban) clears all
bans or lifts active short-term bans via a single ranged UPDATE (replacing the
legacy PHP loop). Add CSRF and PRG redirect to /admin/bans. Point the ban list
Amnesty button at the new URL. This removes the last use of includes/ban_panel.php,
so drop it and its dispatcher entry.

Move user deletion to DeleteUserController (rights>=9 super-group):
GET /admin/users/{id}/delete confirmation + POST cascade delete.
GetUserDeletionContextUseCase guards the target (not self, exists, not higher
rights) and returns activity counts via UserDeletionRepositoryInterface
(Capsule counts across comment/forum tables); DeleteUserUseCase reuses the
system UserClean cascade with optional comments/forum cleanup. Re-run the guard
on POST; add CSRF. Remove includes/usr_del.php and the dispatcher entry; update
the profile Delete button to /admin/users/{id}/delete.

Move database cleanup to UserCleanupController (GET confirm /admin/users/cleanup
+ POST run). InactiveUsersRepositoryInterface (Eloquent User + ForumUnread)
selects dead profiles; CleanupInactiveUsersUseCase reuses the system UserClean
cascade and clears forum read marks. Convert the GET ?mod=1 trigger to a POST
form with CSRF and PRG redirect. Remove includes/usr_clean.php and the dispatcher
entry; point both sidebars at /admin/users/cleanup.

Move registration moderation to RegistrationModerationController:
list pending (preg=0) + approve/approve-all/delete/delete-all/delete-by-ip.
Add RegistrationModerationRepositoryInterface (Eloquent User/IpHistory),
GetPendingRegistrations/Approve/Delete use cases and RegistrationRowMapper
(adds raw integer IP for the remove-by-IP action). Convert GET ?mod= mutations
to POST forms with CSRF and PRG redirects. Remove includes/reg.php and the
dispatcher entry; point both sidebars at /admin/registrations.

Move language management to LanguagesController (rights>=9 super-group):
index/save (default language + list rescan), manage, install/update/delete.
Replace the static Languages.php with injectable use cases and infrastructure
adapters: FileSystemLanguageFilesManager (scan/remove/writability) and
HttpLanguageCatalog (external johncms.com catalog + zip install) behind domain
interfaces. Config writes reuse SystemConfigRepositoryInterface. Convert
install/update/delete GET links to POST forms with CSRF; add PRG redirects.
Remove includes/languages/, Languages.php and the dispatcher entry; point both
sidebars at /admin/languages.

Move smilies cache rebuild to EmoticonsController (GET landing /admin/emoticons
+ POST /admin/emoticons rebuild). Scan filesystem behind SmiliesScannerInterface
(FileSystemSmiliesScanner) and persist via SmiliesCacheRepositoryInterface
(FileSmiliesCacheRepository), preserving the existing serialized cache contract.
Add CSRF and PRG redirect (legacy rebuilt on plain GET). Remove includes/emoticons.php
and its dispatcher entry; point both sidebars at /admin/emoticons.

Move system settings to SystemSettingsController (GET/POST /admin/settings).
Introduce the rights>=9 gate pattern: SuperAdminAccessMiddleware mirrors
AdminAccessMiddleware with the SUPER_ADMIN threshold and is self-contained,
since group middleware does not propagate into nested route groups. Settings
live in a nested super-group; future rights>=9 actions go there too. Extract
the theme list behind ThemeListProviderInterface. Reuse the config writer; add
CSRF and PRG redirect. Remove includes/settings.php and its dispatcher entry;
point both sidebars at /admin/settings.

Move antiflood settings to AntifloodSettingsController (GET/POST /admin/antiflood).
Reuse the config writer (SystemConfigRepositoryInterface) introduced for the
modules-access page; clamp ranges in UpdateAntifloodSettingsUseCase. Add CSRF
and PRG redirect (legacy had neither). Remove includes/antiflood.php and its
dispatcher entry; point both sidebars at /admin/antiflood.

Move ?act=access to GET/POST /admin/modules-access in the admin group.
Introduce a reusable config writer (SystemConfigRepositoryInterface +
FileSystemConfigRepository writing the johncms key to system.local.php,
throwing ConfigWriteException on failure) for the upcoming settings pages.
UpdateModulesAccessUseCase + ModulesAccessDTO carry the eight access flags.

Add CSRF protection to the form and switch to PRG (flash + redirect) on
success. Both sidebars now link to /admin/modules-access.