Disable legacy HTTP image hooks by default

.gitignore

@@ -2,6 +2,7 @@
 /hook/logs.txt
 /hook/list.json
 /hook/HashKey.php
+/hook/legacy-enabled
 /hook/inventory.v2.json
 /.env
 /secrets/*

README.md

@@ -77,6 +77,13 @@ Use branch filter `master`. Disable the old PHP webhook before enabling the new
 writer. The legacy PHP files remain in `hook/` for an explicit rollback, but
 PHP and Node must never mutate the checkout concurrently.
 
+Legacy HTTP mutation is disabled by default. An emergency PHP rollback must
+first stop `image-hook`, then create the ignored `hook/legacy-enabled` sentinel
+in the legacy checkout before restoring its Caddy/Gitea route. Remove the
+sentinel before Node is started again. CLI execution of `hook/git_pull.php`
+from the `hook/` directory remains available for local recovery without
+exposing the HTTP endpoint.
+
 ### Start and verify
 
 ```sh

hook/InstallKey.php

@@ -2,6 +2,13 @@
 namespace sammo\img_service;
 
 header('Content-Type: application/json');
+if (!file_exists(__DIR__.'/legacy-enabled')) {
+    http_response_code(410);
+    die(json_encode([
+        'result'=>false,
+        'reason'=>'legacy key installation disabled',
+    ]));
+}
 
 
 $json_response = [

hook/git_pull.php

@@ -1,6 +1,16 @@
 <?php
 namespace sammo\img_service;
 
+if (php_sapi_name() !== 'cli' && !file_exists(__DIR__.'/legacy-enabled')) {
+    header('Content-Type: application/json');
+    http_response_code(410);
+    die(json_encode([
+        'result'=>false,
+        'reason'=>'legacy pull disabled',
+        'version'=>null,
+    ]));
+}
+
 include(__DIR__.'/HashKey.php');
 
 function hashPassword($salt, $password)

hook/hook.php

@@ -2,6 +2,15 @@
 
 namespace sammo\img_service;
 
+header('Content-Type: application/json');
+if (!file_exists(__DIR__.'/legacy-enabled')) {
+    http_response_code(410);
+    die(json_encode([
+        'result'=>false,
+        'reason'=>'legacy hook disabled',
+    ]));
+}
+
 include(__DIR__.'/gogs_key.php');