TiviMate / API Tools backend for https://ai.apitols.com/tivi2/

DEPLOY
1. Upload the CONTENTS of this folder to the document path that serves:
   https://ai.apitols.com/tivi2/
2. PHP requirements: PHP 8.x, SQLite3, OpenSSL, JSON.
3. Make storage/ writable by the web/PHP user (typically 775).
4. Open https://ai.apitols.com/tivi2/ and sign in:
   user: admin
   pass: change-me-now
   Change config.php immediately after first login.
5. Health check (does not require APK key):
   https://ai.apitols.com/tivi2/api/health.php

APK API KEY
X-XTV-Key: apitols_9f4c2d7a1e8b6c3d0f1
The patched APK contains this new key in place of the seller build's old key.

CUSTOM APK ENDPOINTS FOUND BY STATIC ANALYSIS
/api/device/register.php
/api/device/resolve.php?mac=
/api/vpn/
/api/ui.php
/api/sports.php

BEHAVIOR
- First app registration stores the installation MAC/device id in Devices.
- You can also enter a MAC manually and assign Xtream credentials.
- resolve.php returns assignment revision + URL/user/pass to that installation.
- VPN profiles support global delivery or a target MAC.
- VPN endpoint returns config/ovpn/profile aliases to tolerate the APK's expected JSON naming.
- access.ndjson under storage records registration/resolve/VPN requests for first-run protocol verification.

IMPORTANT FIRST TEST
This backend was matched from static APK analysis. The exact custom protocol can be finalized from the first real device request/response if any field name differs. Check storage/access.ndjson and the PHP/web error log after the first launch.

SECURITY
- API calls require the APK's new X-XTV-Key by default.
- storage/, config.php and lib.php are blocked by .htaccess.
- Do not expose panel.sqlite or access.ndjson publicly.
