fix: harden CMS security controls

cms/controller/index.php

@@ -1,6 +1,15 @@
 <?php
+/**
+ * JSON API entry point for authenticated CMS operations.
+ *
+ * The controller performs authentication, authorisation, CSRF validation, and dispatch. Keeping
+ * this file thin makes it harder for an endpoint to wander off and invent its own security rules.
+ */
+
+// Load the site-specific credentials, roles, and content settings.
 require_once "../config.php";
 
+// Resolve NeoCMS namespaces to the matching class beneath cms/src/.
 spl_autoload_register(function ($class) {
     $classPath = str_replace('\\', DIRECTORY_SEPARATOR, $class);
     require_once "../src/{$classPath}.php";
@@ -8,6 +17,6 @@ spl_autoload_register(function ($class) {
 
 use NeoCMS\CMSController;
 
-// Instantiate the controller with necessary dependencies
+// Dispatch the current request and allow the controller to emit its JSON response.
 $controller = new CMSController($config ?? []);
-$controller->handleRequest();
+$controller->handleRequest();