- contact.php now inserts submissions into MySQL via PDO prepared
statements; raw values stored (htmlspecialchars moved to output only)
- www/includes/db.php: shared PDO helper with auto-migration that adds
the is_read column to existing deployments without a full DB reset
- docker/mysql/init.sql: added is_read TINYINT column to contacts table
for fresh deploys
- www/pages/admin-inbox.php: self-contained staff inbox at /staff-portal
with session-based password login, per-message mark-as-read, and
mark-all-read; unread count shown in browser tab title
- index.php: routes /staff-portal before public header/footer so the
admin page is fully standalone
- docker-compose.yml: ADMIN_PASS env var wired to web container
Set ADMIN_PASS in .env (gitignored) before deploying.
If the DB volume already exists, the auto-migration in db.php will
add the is_read column automatically on first request.
https://claude.ai/code/session_015wpwmheufcxkBuXivrSHhd
