[dolonet]

Summary

curl_close() has been a no-op since PHP 8.0, and PHP 8.5 deprecates it. On hosts with display_errors on, the deprecation notice ends up in every JSON response that api.php proxies. If output buffering is also off, that early output makes http_response_code() fail with "headers already sent", so backend error statuses reach the browser as 200. For example, a 404 for a dead session arrives as a 200.

• api.php: a new release_curl() helper calls curl_close() only below PHP 8.0, where it still frees the handle. It replaces all 7 call sites.
• tests/php/smoke.sh:
  • Runs php -S with display_errors=1, error_reporting=-1 and output_buffering=0, so notices and lost statuses can't be hidden by the runner's ini.
  • Strictly parses every reply as JSON.
  • Adds cases for status forwarding (via a stub session that returns 404) and the upload, download and stream helpers.
• CI: the PHP job now runs the smoke on PHP 7.4 and 8.5.

Test plan

• Smoke passes on PHP 7.4, 8.2, 8.3 and 8.5.
• On PHP 8.5, the smoke fails against the unpatched api.php: the deprecation notice shows up in the body, and 404 becomes 200.
• CI green on both matrix legs