- App\Controllers\LocaleController: GET /locale?set=xx&return=/path - Sets 1-year cookie (HttpOnly=false for SSR, SameSite=Lax, Secure on HTTPS) - 302 redirect to explicit return URL > Referer > / - Pure buildResponse() helper for unit tests (no headers/exit) - current() helper: resolves locale from $_GET/$_COOKIE/Accept-Language - safeRedirect: rejects absolute URLs, protocol-relative (//evil.com), backslash tricks (\\evil.com), javascript:/data: schemes - 28 PHPUnit tests (LocaleControllerTest), all green - Total project tests now: 92
- Add composer.json with PHPUnit 11 and PSR-4 autoloading - Add phpunit.xml configuration - Rename app/core/ → app/Core/ and app/controllers/ → app/Controllers/ (PSR-4) - Add 18 unit tests for App\Core\Router (31 assertions) - addRoute(): default action, custom action, overwrite - dispatch(): URL normalization, direct match, legacy redirects - dispatch(): 404 handling, controller/action not found exceptions - TestableRouter subclass to intercept side-effects - Update .gitignore (vendor/, .phpunit.cache/)