MAIL SENDER — MULTI-SENDER EDITION
====================================

WHAT CHANGED FROM V1
---------------------
Instead of one hardcoded mailbox in config.php, you now manage a list of
"senders" from admin.php. Each sender is a REAL mailbox you control, added
with its own SMTP host/port/username/password. When you add one, the app
does a live SMTP login test before saving it — if the login fails, it's
marked "unverified" and won't show up as a send option until it works.

On the send form you pick which verified sender to send FROM via a dropdown.

WHY IT STILL WORKS THIS WAY (AND WHY THAT MATTERS)
-----------------------------------------------------
Every sender must be a mailbox you actually own and can authenticate to.
This is NOT a from-address spoofer — you can't type in an arbitrary email
you don't control and send mail claiming to be it. That's intentional:
- Spoofed From headers fail SPF/DKIM/DMARC and get dumped in spam, or
  bounced outright by major providers (Gmail, Outlook, etc.)
- An open relay that lets anyone claim any identity is exactly the abuse
  pattern that gets shared hosting accounts suspended by Namecheap
- Each sender here authenticates with real credentials, so mail from it
  passes normal deliverability checks

If you have 5 mailboxes (support@, sales@, admin@, etc. — on the same or
different domains you own), add all 5 in admin.php and switch between them
per send.

SETUP STEPS
-----------
1. Edit config.php:
   - access_key: long random string — gates BOTH admin.php and index.php
   - encrypt_key: another long random string — encrypts stored SMTP
     passwords in senders.sqlite. Keep this secret; if it leaks, anyone
     with DB access can decrypt your mailbox passwords.

2. Upload the whole folder (index.php, admin.php, lib.php, config.php,
   PHPMailer/) to your Namecheap hosting, e.g. public_html/mailer/

3. senders.sqlite is created automatically on first run — make sure the
   folder is writable by PHP (usually fine by default on Namecheap
   shared hosting).

4. Go to yourdomain.com/mailer/admin.php — enter your access key, add each
   mailbox you want to send from (label, from name, from email, SMTP host/
   port/secure, SMTP username/password). It's tested live on save.

5. Go to yourdomain.com/mailer/index.php — pick a sender from the dropdown,
   fill in the recipient and message, send.

SECURITY NOTES
---------------
- Change access_key and encrypt_key from the defaults before deploying.
- Consider moving config.php and senders.sqlite outside the web root if
  your host allows it, so they're never directly downloadable.
- Add a .htaccess rule to block direct access to senders.sqlite as a
  belt-and-suspenders measure:

    <Files "senders.sqlite">
      Require all denied
    </Files>

- If this becomes public-facing, add a rate limit per sender to avoid
  tripping your mail provider's sending limits.
