Clear stale HTTP_* headers from $_SERVER between persistent PHP dispatches

[simonhamp]

Summary

Fixes raw Inertia JSON being rendered after a top-level navigation following an Inertia visit (reported on iOS, latent on Android).

In the persistent PHP runtime, $_SERVER is a regular superglobal that survives across zend_eval_string() dispatches. The dispatch eval layered new env vars on top with foreach (getenv() as $__k => $__v) { $_SERVER[$__k] = $__v; } but never removed keys from prior requests. Once an Inertia XHR set HTTP_X_INERTIA = 'true', that key remained in $_SERVER for every subsequent request — even after the C-level env var was unset — so a plain window.location.href = '/home' navigation hit Inertia's middleware and got JSON back.

This patch strips HTTP_*, CONTENT_TYPE, and CONTENT_LENGTH keys from $_SERVER at the top of every dispatch in both the iOS (PHP.c) and Android (php_bridge.c) eval blocks, addressing the root cause for any stale request header rather than a single Inertia-specific symptom.

The existing Kotlin band-aid in PHPBridge.kt (which zeroes the five Inertia-specific env vars before each dispatch) becomes redundant but is left in place as defense-in-depth — happy to remove on request.

Test plan

• Run an Inertia visit, then window.location.href = '/home' on iOS — confirm full HTML loads, not raw JSON
• Same scenario on Android (already worked via Kotlin workaround; confirm still works)
• Confirm regular Inertia XHR navigation still receives JSON correctly
• Confirm POST requests with Content-Type continue to parse $_POST correctly after the clearing step

🤖 Generated with Claude Code