Server: portable rewrite + JSON-only error handler

The previous .htaccess used PATH_INFO (api/index.php/$1) which OVH mutualisé
does not always allow, producing an Apache 500 HTML page that masked our own
JSON error reporting.

Switch to query-string routing (?route=...): same effect, works everywhere.
Add a global exception handler in index.php that emits JSON errors only —
no more opaque Apache 500.

Add a /api/debug endpoint that reports PHP version, sodium availability,
pdo_mysql, and whether versions.json is found. Useful for diagnosing
shared-hosting setup before adding license logic.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/.htaccess

@@ -1,28 +1,15 @@
 RewriteEngine On
 RewriteBase /PS_Launcher/
 
-# HTTPS forcé
+# HTTPS forcé (si le mutualisé OVH ne le force pas déjà)
 RewriteCond %{HTTPS} off
 RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
 
 # Pas de listing de répertoires
 Options -Indexes
 
-# /PS_Launcher/api/* → api/index.php (le PATH_INFO est exposé via QUERY_STRING)
-RewriteRule ^api/?$    api/index.php [QSA,L]
-RewriteRule ^api/(.*)$ api/index.php/$1 [QSA,L]
-
-# Bloquer l'accès direct aux fichiers sensibles
-<FilesMatch "\.(sql|md\.bak|log|env)$">
-    Require all denied
-</FilesMatch>
-
-# Headers de sécurité
-<IfModule mod_headers.c>
-    Header set X-Content-Type-Options "nosniff"
-    Header set X-Frame-Options "DENY"
-    Header set Referrer-Policy "no-referrer"
-</IfModule>
-
-# Type MIME pour les ZIPs (assure la pris en compte de Range:)
-AddType application/zip .zip
+# /PS_Launcher/api      -> api/index.php
+# /PS_Launcher/api/foo  -> api/index.php?route=foo
+# (passage par query string : pas de PATH_INFO, marche partout)
+RewriteRule ^api/?$              api/index.php                        [QSA,L]
+RewriteRule ^api/([^?]+)/?$      api/index.php?route=$1               [QSA,L]