Update codebase

backend/food/merchant_auth/login.php

@@ -0,0 +1,41 @@
+<?php
+// food/merchant_auth/login.php — دخول لوحة المطعم (هاتف + كلمة مرور)
+require_once __DIR__ . '/../../core/bootstrap.php';
+require_once __DIR__ . '/../functions.php';
+
+if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') { http_response_code(200); exit; }
+
+$limiter = new RateLimiter($redis);
+$limiter->enforce(RateLimiter::identifier(), 'login');
+
+requireFoodFields(['phone', 'password']);
+$phone    = normalizePhone(filterRequest('phone'));
+$password = filterRequest('password');
+
+try {
+    $food_con = Database::get('food');
+} catch (Exception $e) {
+    jsonError('Food service unavailable', 503);
+}
+
+$st = $food_con->prepare(
+    "SELECT id, merchant_id, password_hash, is_active FROM food_merchant_users WHERE phone=? LIMIT 1"
+);
+$st->execute([$phone]);
+$user = $st->fetch();
+
+if (!$user || !$user['is_active'] || !password_verify($password, $user['password_hash'])) {
+    appLog("[FOOD][MERCHANT_LOGIN] failed attempt for phone hash " . hash('sha256', $phone), 'WARNING');
+    jsonError('Invalid credentials', 401);
+}
+
+$merchantSt = $food_con->prepare("SELECT status FROM food_merchants WHERE id=?");
+$merchantSt->execute([$user['merchant_id']]);
+$merchant = $merchantSt->fetch();
+if (!$merchant || !in_array($merchant['status'], ['active', 'paused'], true)) {
+    jsonError('Merchant account is not active', 403);
+}
+
+$token = foodCreateMerchantSession((int)$user['id'], (int)$user['merchant_id']);
+
+jsonSuccess(['session_token' => $token, 'merchant_id' => (int)$user['merchant_id']], 'Login successful');