fix(install): repair web+CLI installer flow and harden install endpoint

The web installer was unusable: Install::index() redirected to
install/dbsetup via HTTP 302 (GET) but the route was registered POST-only,
producing "404 Can't find a route for 'GET: install/dbsetup'" on every
fresh installation. Refactored index() to invoke dbsetup() directly in
the same request — no HTTP redirect, no flashdata round-trip — and
removed the install/dbsetup route entirely. dbsetup() is now private
and accepts the installation payload as a typed array parameter,
eliminating the externally callable seed endpoint and shrinking the
installer's attack surface to a single InstallFilter-protected route.

The CLI installer (php spark ci4ms:setup) aborted at Step 5/6 with
"BLOB, TEXT, GEOMETRY or JSON column 'profileIMG' can't have a default
value" because the users table migration declared profileIMG as TEXT
with a string default — rejected by MySQL/MariaDB in strict mode (the
default on most distros). Changed the column to VARCHAR(255) NULL so
the default URL is preserved and the migration succeeds on every
supported server version.

Bumped app.version to 0.31.11.0 in both installer paths so freshly
written .env files report the correct release.

Files changed:
- modules/Install/Controllers/Install.php — dbsetup() private + direct call
- modules/Install/Config/Routes.php — removed install/dbsetup route
- modules/Auth/Database/Migrations/2026-02-25-062805_CreateUsersTable.php
  — profileIMG TEXT → VARCHAR(255) NULL
- modules/Backend/Commands/Ci4msSetup.php — app.version bump
- CHANGELOG.md, docs/codebase-walkthrough.md — release docs

Author: bertugfahriozer

CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html) conventions adapted to the existing four-component version numbers.
 
+## [0.31.11.0] - 2026-05-24
+
+### Fixed
+
+- **CRITICAL — Web Installer Broken (404 on `/install/dbsetup`):** `Install::index()` redirected the browser to `install/dbsetup` after writing `.env`, but the route was registered as `POST`-only. The 302 redirect issued a `GET` request, producing `404 — Can't find a route for 'GET: install/dbsetup'` and aborting every web installation. The two-step request flow also relied on flashdata that was lost across the redirect on some session drivers. `index()` now invokes the migration + seed pipeline directly in the same request (no HTTP redirect, no flashdata), and the `install/dbsetup` route was removed entirely to eliminate the dead public endpoint. Reported by community installation feedback.
+- **CRITICAL — CLI Installer Migration Failure (`profileIMG` Default Value):** The `users` table migration declared `profileIMG` as `TEXT NOT NULL` with a string `default`. MySQL/MariaDB reject this with `BLOB, TEXT, GEOMETRY or JSON column 'profileIMG' can't have a default value` on every server version that does not silently relax the rule (most Linux distros, all default strict-mode installs), so `php spark ci4ms:setup` aborted at Step 5/6 before the database was usable. Changed the column to `VARCHAR(255) NULL` so the default URL is preserved and the migration succeeds on every supported MySQL/MariaDB version.
+
+### Changed
+
+- **Install Controller Hardening:** `dbsetup()` is now `private` and accepts the installation payload as a typed `array` parameter, removing the externally callable seed endpoint, the flashdata round-trip, and the empty-payload guard. The `install_dbsetup` route alias and its `role=create` permission are gone, shrinking the installer's attack surface to a single endpoint protected by `InstallFilter` (which returns `404` once `writable/install.lock` exists).
+- **Version Bump:** `app.version` advanced to `0.31.11.0` in both `Install::index()` and `Ci4msSetup::run()` so freshly written `.env` files report the correct release.
+
 ## [0.31.10.0] - 2026-05-23
 
 ### Fixed

docs/codebase-walkthrough.md

@@ -397,7 +397,7 @@ All settings methods clear the `settings` cache after saving.
 2. `copyEnvFile()` copies `env` → `.env`
 3. `updateEnvSettings()` writes all config values to `.env` (regex-based key=value replacement)
 4. `generateEncryptionKey()` creates `hex2bin:` prefixed random key
-5. Redirects to `/install/dbsetup` with user data in query params
+5. `index()` invokes the private `dbsetup($installData)` directly in the same request — no HTTP redirect, no flashdata, no public endpoint
 6. `dbsetup()`:
    - Runs `$migrate->latest()` to create all database tables
    - Calls `InstallService::createDefaultData()` to seed the database

modules/Auth/Database/Migrations/2026-02-25-062805_CreateUsersTable.php

@@ -20,8 +20,9 @@ public function up()
                 'null' => false,
             ],
             'profileIMG' => [
-                'type' => 'TEXT',
-                'null' => false,
+                'type' => 'VARCHAR',
+                'constraint' => '255',
+                'null' => true,
                 'default' => 'https://dummyimage.com/50x50/ced4da/6c757d.jpg',
             ],
             'who_created' => [

modules/Backend/Commands/Ci4msSetup.php

@@ -220,7 +220,7 @@ public function run(array $params)
             'app.supportedLocales'               => '["ar","de","en","es","fr","hi","ja","pt","ru","tr","zh"]',
             'app.negotiateLocale'                => 'true',
             'app.appTimezone'                    => '\'Europe/Istanbul\'',
-            'app.version'                        => '0.31.10.0',
+            'app.version'                        => '0.31.11.0',
         ];
 
         if (!$this->updateEnvSettings($updates)) {

modules/Install/Config/Routes.php

@@ -1,5 +1,4 @@
 <?php
 $routes->group('install', ['namespace' => 'Modules\Install\Controllers'], function ($routes) {
         $routes->match(['GET', 'POST'], '/', 'Install::index', ['as' => 'install','role'=>'create']);
-        $routes->post('dbsetup', 'Install::dbSetup', ['as' => 'install_dbsetup','role'=>'create']);
 });

modules/Install/Controllers/Install.php

@@ -67,12 +67,12 @@ public function index()
                 'app.supportedLocales' => '["ar","de","en","es","fr","hi","ja","pt","ru","tr","zh"]',
                 'app.negotiateLocale' => 'true',
                 'app.appTimezone' => '\'Europe/Istanbul\'',
-                'app.version' => '0.31.10.0'
+                'app.version' => '0.31.11.0'
             ];
             if ($this->copyEnvFile() && $this->updateEnvSettings($updates)) $this->generateEncryptionKey();
 
 
-            $sessionData = [
+            $installData = [
                 'name' => $this->request->getPost('name'),
                 'surname' => $this->request->getPost('surname'),
                 'username' => $this->request->getPost('username'),
@@ -81,9 +81,9 @@ public function index()
                 'siteName' => $this->request->getPost('siteName'),
                 'baseUrl' => $this->request->getPost('baseUrl'),
             ];
-            if ($this->request->getPost('slogan')) $sessionData['slogan'] = $this->request->getPost('slogan') ?: null;
-            session()->setFlashdata('install_data', $sessionData);
-            return redirect()->to(site_url('install/dbsetup'));
+            if ($this->request->getPost('slogan')) $installData['slogan'] = $this->request->getPost('slogan') ?: null;
+
+            return $this->dbsetup($installData);
         }
         return view('Modules\Install\Views\install');
     }
@@ -134,7 +134,7 @@ private function generateEncryptionKey()
         return true;
     }
 
-    public function dbsetup()
+    private function dbsetup(array $installData)
     {
         $migrate = \Config\Services::migrations();
         $baseURL = rtrim(base_url(), '/');
@@ -145,8 +145,6 @@ public function dbsetup()
             return redirect()->route('install')->withInput()->with('errors', ['migration' => $e->getMessage()]);
         }
         $createDBs = new InstallService();
-        $installData = session()->getFlashdata('install_data');
-        if (empty($installData)) return redirect()->to($baseURL);
         $createDBs->createDefaultData([
             'fname' => trim(strip_tags($installData['name'])),
             'sname' => trim(strip_tags($installData['surname'])),