# Route every /api/* request to the PHP router (single entry point)
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^ index.php [QSA,L]

# Never expose config
<Files "config.php">
  Require all denied
</Files>
