port to php 8.4 (debian 13)

port to php 8.4 (debian 13)

The code was written for php 5. Minimal changes to make it run cleanly on
8.4, with no restructuring.

Fatal errors
- split() -> explode() (removed in 7.0), 5 places
- "$x =& new Class()" -> "= new" (removed in 7.0), 7 places
- 41 php4 style constructors -> __construct(). A non obvious case: Bin5_user
  defined "function User() {}", which on php5 was its constructor because it
  overrode the slot inherited from User; that one was renamed too.
- 15 static calls to non static methods (Challenges::load_data(),
  Hardbans::add(), Table::create(), ...): E_STRICT on php5, Error since 8.0.
  "static" added to the 8 declarations, none of them uses $this.
- 5 overrides with incompatible signatures (spawn, copy, load_step,
  unproxy_step, page_sync): E_STRICT on php5, fatal since 8.0. The useless
  "&" on objects were dropped and the parameters of three methods reordered,
  with the two call sites adjusted.
- dbase_pgsql.phh: pg_result_status($res) was called in the branch where
  $res is FALSE. Since 8.0 results are \PgSql\Result objects and no longer
  resources, so it is not a warning any more but a fatal TypeError - and in
  the connection recovery path, of all places. Replaced with pg_last_error().
- dbase_pgsql.phh: "${rules_name}::game_description(...)" was a variable
  variable whose name came from an undefined constant; on php5 it degraded to
  a string with a notice and resolved to $rules_name by accident, on php8 it
  is a fatal Error.
- dbase_file.phh: define() with an unquoted constant name, same mechanism.
- usermgmt.php: "break" outside any loop. On php5 it was a runtime fatal,
  since 7.0 it is a compile time one: the file did not load any more.

Deprecations
- 245 "var $prop" -> public
- 29 occurrences of "${var}" inside strings -> "{$var}" (8.2)
- 29 dynamic properties declared (8.2). User declared $brisk but the code
  always uses $room: renamed, nobody reads $user->brisk.
- 53 pg_numrows() -> pg_num_rows(): the alias is deprecated in 8.4
- strftime() -> date(), shmop_close() -> unset()
- room_join_wakeup(): removed a default followed by a mandatory parameter

mbstring.func_overload
It was set to 7 in the .htaccess files and was removed in 8.0. All 62 call
sites of strlen/substr/strpos were examined: they are either pure ASCII or
deliberately byte oriented, and moving to php8 fixes them, given that the
websocket frame parsing in transports.phh and the fwrite accounting in
sac-a-push.phh would have been wrong under overload. No change needed: where
character semantics were required the author already used explicit mb_*.
The only exception is index_wr.php, where mail() is no longer remapped onto
mb_send_mail(): mb_encode_mimeheader() was added on the subject and on the
user name, which otherwise ended up as raw UTF-8 in the headers.

Configuration (debian 13)
- .htaccess: func_overload removed, internal_encoding/http_input replaced by
  default_charset; the php_value block now sits inside <IfModule mod_php.c>
  because with PHP-FPM apache would answer 500
- the three .htaccess that protect the sources used the apache 2.2 syntax
  (Order/Deny), which needs mod_access_compat: now "Require all denied" with
  a fallback
- system/etc_php5_conf.d_mbstring.ini -> etc_php8.4_conf.d_brisk.ini
- INSTALL.sh: "php5 -l" -> "php -l"

Checked: php -l clean on 64 files; the whole include chain of the daemon
loads with E_ALL without warnings or deprecations; the tests in test/ pass.
Not yet verified against a database: dbase_pgsql.phh was only checked
statically.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014M1jiEq9cHdE5SE5j6vFuE