Six classes, under 1,500 lines of PHP. The whole application is about 6,500 - small enough to hand an assistant all of it at once.
Security First
Every POST is checked for a CSRF token before it reaches a controller. Prepared statements, hashed passwords, and a wrong-password counter per IP address.
Modern UI
Tailwind CSS v4 compiled into one committed stylesheet, responsive layouts, and an admin dashboard.
Database Ready
A thin mysqli wrapper with prepared-statement helpers, and one script that creates and seeds the schema.
MVC Architecture
Routing, controllers, models, views and layouts, each with one job and one place to look.
Developer Tools
Central error and exception handling, dated error logs, and real 404 and 500 pages.