# Ensure the PWA manifest is served with the correct MIME type.
AddType application/manifest+json .webmanifest

# Never serve config.php over HTTP (defense in depth — deploy.sh already excludes it).
<Files "config.php">
    Require all denied
</Files>