multi-tenant relay und card-push to user

relay/.htaccess

@@ -3,6 +3,11 @@ RewriteEngine On
 # Block direct access to data directory
 RewriteRule ^data/ - [F,L]
 
+# Block direct execution of include files (defense in depth — they also
+# check RELAY_BOOTSTRAPPED at the top of each file).
+RewriteRule ^inc/ - [F,L]
+RewriteRule ^ui/.*\.php$ - [F,L]
+
 RewriteCond %{REQUEST_FILENAME} !-f
 RewriteCond %{REQUEST_FILENAME} !-d
 RewriteRule ^ index.php [L]