2.5.4

Upgraded pro/extra access

dev-unlock.php

@@ -0,0 +1,17 @@
+<?php
+// ─── SunScope Extra — Dev Pro Unlock ──────────────────────────────────────────
+// JSON endpoint for the site owner's own testing. Visiting the app with
+// ?dev=<DEV_UNLOCK_TOKEN> triggers a call here; only a matching token flips
+// Pro on. Replaces the old bare ?pro=1 trick, which anyone could type in.
+//
+// Returns {"ok": bool}
+
+require __DIR__ . '/secrets.local.php';
+
+header('Content-Type: application/json');
+
+$token = trim($_GET['token'] ?? $_POST['token'] ?? '');
+
+$ok = $token !== '' && hash_equals(DEV_UNLOCK_TOKEN, $token);
+
+echo json_encode(['ok' => $ok]);