fix: harden portable host installation

public/.htaccess

@@ -1,5 +1,10 @@
 RewriteEngine On
 RewriteBase /
+Options -Indexes
+
+# The public/ directory must be the virtual host document root. This file is
+# defense in depth only and cannot protect files in parent directories.
+RewriteRule "(^|/)[.]" - [F,L]
 
 # Keep real assets accessible and route application requests through the front controller.
 RewriteCond %{REQUEST_FILENAME} -f [OR]
@@ -7,7 +12,7 @@ RewriteCond %{REQUEST_FILENAME} -d
 RewriteRule ^ - [L]
 RewriteRule ^ index.php [L]
 
-# Never expose environment/config/database files through Apache.
-<FilesMatch "^(\.env|.*\.(sql|log|ini))$">
+# Deny common sensitive artifacts if this file is accidentally reused elsewhere.
+<FilesMatch "^(\.env|.*\.(sql|log|ini|yaml|yml|json|lock))$">
     Require all denied
 </FilesMatch>