iEduPortal Stage 6 — Clean Login Migration

This package is a clean replacement for the four legacy login pages and the
Stage 6 authentication core. It is designed to be uploaded once into the
existing public/ directory without importing SQL.

LOGIN-TIME PASSWORD MIGRATION

For admin, staff, parent, and pupil:
1. The submitted username is looked up with a prepared statement.
2. If the stored password is already a password_hash() value, password_verify()
   is used.
3. If the stored password is legacy plaintext, the submitted password is
   compared to that value.
4. ONLY after a successful legacy-plaintext login, the password is immediately
   replaced with password_hash(PASSWORD_DEFAULT).
5. The login then continues normally.

No password is placed in SQL, a URL, a session, or a log.

IMPORTANT
- Do NOT import SQL.
- Do NOT replace connection.php.
- Upload the contents of this ZIP into school-management-system/public/.
- Remove any old temporary upgrade/stage6diag*, upgrade/stage6reset*, or
  similar diagnostic/reset folders after testing.
- A wrong password will NOT be automatically accepted or changed.
  Automatic hashing happens only after the existing plaintext password matches.

TEST

Pupil:
  Pupil1 / Pupil1

For other accounts, use the password currently stored for that account.
If a legacy plaintext password is correct, that first successful login will
migrate it to a secure password hash automatically.
