SHREE RAM CLUB V3.9.7 - REVIEW / BUG-FIX NOTES

Fixed in this build:
1. Admin login uses the SQL/PHP authentication only. The admin password is no longer hard-coded in JavaScript.
2. Customer login uses the SQL/PHP authentication only; localStorage credentials are no longer accepted as a login bypass.
3. Public customer signup no longer silently creates a local-only account when PHP/MySQL is unavailable.
4. Customer profile update cannot change available points, total points, or account status through client-side requests.
5. Customer accounts cannot write server-controlled point ledger, redemption, or notification records through the generic save API.
6. Point-lock calculation now uses the CURRENT Admin lock-period setting for every positive point entry. Changing the lock period immediately changes Locked/Redeemable status in the UI.
7. Server-side redemption now checks CURRENT redeemable points from the point ledger, so locked points cannot be redeemed by manipulating browser data.
8. Deleted-customer tombstones are also checked during stale signup-request synchronization, preventing an old pending browser request from recreating a deleted account.
9. PHP and JavaScript syntax checks passed.

IMPORTANT DEPLOYMENT:
- This version is a PHP + MySQL application. Do not open index.html with file://.
- Import database.sql into MySQL first.
- Update config.php with the real database name/user/password.
- The supplied SQL administrator account is username 8053988002. The password is stored only as a bcrypt hash in database.sql.
- After first login, change the administrator password using a server-side admin-password feature when one is added; do not place passwords in JavaScript or localStorage.
