live bug fixed

public/.htaccess

@@ -18,7 +18,16 @@ Options -Indexes
     RewriteEngine On
     RewriteBase /
 
-    # Admin routes: /admin/login → admin.php?route=login
+    # Serve theme assets via asset.php (themes are outside webroot)
+    RewriteRule ^themes/([^/]+)/assets/(.+)$ asset.php [L,QSA]
+
+    # Serve admin theme assets via asset.php
+    RewriteRule ^admin/assets/(.+)$ asset.php [L,QSA]
+
+    # Serve plugin assets via asset.php
+    RewriteRule ^plugins/([^/]+)/assets/(.+)$ asset.php [L,QSA]
+
+    # Admin routes: /admin/login -> admin.php?route=login
     RewriteRule ^admin$ admin.php?route=dashboard [L,QSA]
     RewriteRule ^admin/(.+)$ admin.php?route=$1 [L,QSA]
 

public/asset.php

@@ -0,0 +1,64 @@
+<?php
+/**
+ * Asset server - serves static files from themes/, admin/theme/, and plugins/
+ * This file is used on production servers where the PHP router is not available.
+ * The .htaccess rewrites /themes/, /admin/assets/, and /plugins/ URLs to this file.
+ */
+
+$basePath = dirname(__DIR__);
+$requestUri = $_SERVER['REQUEST_URI'] ?? '/';
+$path = parse_url($requestUri, PHP_URL_PATH) ?? '/';
+
+$mimeTypes = [
+    'css' => 'text/css',
+    'js'  => 'application/javascript',
+    'svg' => 'image/svg+xml',
+    'png' => 'image/png',
+    'jpg' => 'image/jpeg',
+    'ico' => 'image/x-icon',
+    'woff' => 'font/woff',
+    'woff2' => 'font/woff2',
+    'json' => 'application/json',
+    'map' => 'application/json',
+];
+
+// Determine which asset directory to serve from
+$assetFile = null;
+
+// /themes/<name>/assets/...
+if (preg_match('#^/themes/([^/]+)/assets/(.+)$#', $path, $m)) {
+    $themeName = $m[1];
+    $assetRel = $m[2];
+    $assetFile = $basePath . '/themes/' . $themeName . '/assets/' . $assetRel;
+    $realBase = realpath($basePath . '/themes/' . $themeName . '/assets');
+}
+// /admin/assets/...
+elseif (preg_match('#^/admin/assets/(.+)$#', $path, $m)) {
+    $assetRel = $m[1];
+    $assetFile = $basePath . '/admin/theme/default/assets/' . $assetRel;
+    $realBase = realpath($basePath . '/admin/theme/default/assets');
+}
+// /plugins/<name>/assets/...
+elseif (preg_match('#^/plugins/([^/]+)/assets/(.+)$#', $path, $m)) {
+    $pluginName = $m[1];
+    $assetRel = $m[2];
+    $assetFile = $basePath . '/plugins/' . $pluginName . '/assets/' . $assetRel;
+    $realBase = realpath($basePath . '/plugins/' . $pluginName . '/assets');
+}
+
+if ($assetFile && $realBase) {
+    $realFile = realpath($assetFile);
+    if ($realFile && strpos($realFile, $realBase) === 0 && is_file($realFile)) {
+        $ext = strtolower(pathinfo($realFile, PATHINFO_EXTENSION));
+        if (isset($mimeTypes[$ext])) {
+            header('Content-Type: ' . $mimeTypes[$ext]);
+        }
+        header('Cache-Control: public, max-age=86400');
+        readfile($realFile);
+        exit;
+    }
+}
+
+http_response_code(404);
+header('Content-Type: text/plain');
+echo '404 Not Found';