fixes that showed up by actually running the application on debian 13

fixes that showed up by actually running the application on debian 13

Found by bringing the whole stack up in a container: apache 2.4.68 with
mod_proxy_fdpass2, the brisk-spush daemon on php 8.4 with the ancillary
extension, postgresql 17. None of these was visible with the lint, with
loading the include chain, or with the tests on the objects: they only show
up by starting the daemon and serving a real request.

sac-a-push.phh: fatal when the daemon starts
 sig_handler() was registered with pcntl_signal() as
 array("Sac_a_push", "sig_handler"), that is in static form, but declared
 non static. Since php 8 that is no longer a valid callable and
 pcntl_signal() raises a TypeError: the daemon died before opening a socket.
 It is the same class of problem as the 15 static calls already fixed, but
 with the array() syntax: the check I had written looked for "Class::method"
 and did not see it. The other two callables in that form were checked as
 well (IPClassItem::compare and Cookie::create): both already static.

INSTALL.sh: Etc/ was born exposed on the web
 The Etc directory holds the configuration with $G_dbauth, that is the
 database credentials in clear, and it falls inside the DocumentRoot. The
 .pho extension is not associated with php, so the file was served as plain
 text: checked, HTTP 200 with the content. In production it is protected only
 because someone added a .htaccess by hand; a fresh installation was born
 without one. INSTALL.sh now creates it, in the apache 2.4 form with a 2.2
 fallback. After the change: HTTP 403.

WARNING.txt: the suggested ProxyPass lines did not work
 It is the text INSTALL.sh prints to the administrator as the configuration
 to write, and it was wrong in three ways:
  - "fd:///path" is refused at configuration time by apache 2.4.68
    ("ProxyPass URL must be absolute!"); "fd://localhost/path" is needed
  - it mentioned a single "brisk.sock", from before the pool existed: the
    path is the prefix and the module appends "<N>.sock" to it
  - the hardcoded path /var/www/brisk-priv ignored the -U option
 Rewritten with the form verified to work, plus the note that the first
 argument must be an exact path and not a prefix with a trailing slash.

The file also lists, and this part was already right, which urls go to the
daemon: index.php, index_wr.php, index_rd.php, index_rd_wss.php and the
matching ones under briskin5. Everything else is served by apache.

Final check in the container: GET /brisk/index.php answers 200 with the game
page (19725 bytes), the .css are served by apache, Obj/, spush/ and
briskin5/Obj/ answer 403, Etc/ answers 403, and the daemon does not emit a
single warning or deprecation while serving the requests.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014M1jiEq9cHdE5SE5j6vFuE