v1.3.0 — Referrals, Password Reset, French i18n & Marketing Kit

🎯 New Features

• Referrals system — personal /?ref= links with anti-abuse caps (5/day, 50 lifetime)
• Password reset flow — signed tokens, 1h single-use, auto-login on success
• Marketing kit (/promote.php) — 12 ready-to-share templates × 6 platforms with direct share buttons
• Welcome email sent on registration
• French i18n scaffolding — 60+ strings, cascade fallback to English (community contribution by @sibylassana95 🇸🇳)

🛡️ Security & Hardening

• Admin panel: bcrypt password hashing, idle timeout, audit log, email notifications
• Proxy-aware HTTPS detection (fixes Hostinger CDN redirect loop)
• Dynamic OG image replacing static og.png
• PWA install banner re-shows after 14 days

⚡ Performance

• LIVE_CACHE_TTL 60→120s (halves API-Football consumption)
• Visitor counter DB-backed (survives file uploads)
• Instant lineup display — no more time-gate
• Auto-hashtags on social share (#WeAre26 #FIFAWorldCup26)

🐛 Fixes

• Countdown matches homepage timer exactly (floor vs ceil)

🗄️ Database

3 new lazy-created tables: referrals, password_resets, site_counters

---

Full changelog: v1.0.0...v1.3.0