action: create

detail: Fix Brave request building: lazy URL + single encode


detail: Fix autoloader: use PATH_SEPARATOR instead of hardcoded ':'


detail: Config hygiene: ZAP_DEBUG=false, secrets in git-ignored local file, sessions perms


detail: Add CSRF protection to word-input form


detail: Replace die('Wrong parameter') with proper 404/error handler


detail: Fix and secure cli_scripts/reset.php


detail: Make session folder names unique, stop suppressing mkdir errors


detail: Introduce ZAPHandler interface for getContent()


detail: Single source of truth for word count + cleanup handleWords


detail: Consistent template rendering pattern across all handlers


detail: Consolidate duplicated screen-size constants


detail: Fix convertGifsToPng extension + rename/fix log.xml


detail: Anchor ZAP_APP_BASE_DIR to __DIR__, make getZAPTemplate throw


detail: Refresh README (Yahoo→Brave, drop outdated roadmap, fix tone)


action: edit


action: handoff


action: release