Architecture

Your phone / laptop
        |
        v
relay.vqaria.com  (DNS A record -> 52.6.46.75)
        |
        v
 VQARIA (AWS Lightsail)
 +-- Apache 2.4 + SSL (Let's Encrypt)
 +-- /var/www/relay/         <-- this PHP app
 +-- MySQL: relay_db         <-- sessions, entries, audit, users
 +-- ARIA job_queue          <-- direct localhost write (source='relay')
 +-- PHPMailer               <-- SMTP email for J.J. notifications
        |
        +-- ARIA jobs -------> ARIA job_queue (localhost, no network hop)
        |                       ARIA worker: only processes source='relay'
        |
        +-- Other projects --> RDS message_queue (AWS, existing)
                                claude_dashboard, claude_marketing, etc.

Auth: email + password + TOTP (RFC 6238, pure PHP)
      reCAPTCHA v3 on login, session idle timeout 2h
      Remember-me cookie (30 days, SHA-256 hashed token)