# Architecture Overview

## Request flow
Browser → Apache/Nginx → `public/*.php` → `includes/db.php` (PDO) → MySQL.
JSON endpoints under `public/api/` consumed by `public/js/app.js`.

## Auth
- Sessions via PHP `$_SESSION`
- Login: `POST /api/auth.php?action=login` (JSON) or `POST /admin/login.php` (form)
- Roles loaded via JOIN of `users` × `user_roles`
- Helpers: `current_user()`, `require_login()`, `require_admin()`

## Cart & Offline
- `Cart` object in `app.js` persists items in `localStorage` (`cb_cart`)
- POS uses `sessionStorage` (`pos_cart`) so an in-progress sale survives refresh
- When `navigator.onLine === false`, POS sales are queued in `localStorage.offline_sales` and replayed on `online` event

## Receipts
- POS receipts: `RCT-YYYYMMDD-HHMMSS-RAND` — opened in a new tab and triggers `window.print()`
- Online order numbers: `ORD-YYYYMMDD-XXXX`

## Adding a new page
1. Create PHP file in `public/shop/` or `public/admin/`
2. Include `includes/header.php` and (for admin) `admin/_layout.php` / `_layout_end.php`
3. Use design tokens in `css/styles.css` (no inline brand colors)