fix: read WHITELIST from $_ENV so it works on Vercel

[myl7]

Description

When loading whitelists, change from $_SERVER to $_ENV so Vercel's env can be read.

Fixes #911

Type of change

• Bug fix (added a non-breaking change which fixes an issue)
• New feature (added a non-breaking change which adds functionality)
• Updated documentation (updated the readme, templates, or other repo files)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)

How Has This Been Tested?

• Tested locally with a valid username
• Tested locally with an invalid username
• Ran tests with composer test
• Added or updated test cases to test new features

Checklist:

• I have checked to make sure no other pull requests are open for this issue
• The code is properly formatted and is consistent with the existing code style
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings

Screenshots

[Copilot]

Pull request overview

This PR aims to fix whitelist enforcement on Vercel deployments by changing how the WHITELIST environment variable is read so that configured usernames are actually restricted as intended (per #911).

Changes:

• Switch whitelist loading from $_SERVER["WHITELIST"] to $_ENV["WHITELIST"] in the whitelist check.
• Update PHPUnit tests to set/unset WHITELIST via $_ENV instead of $_SERVER.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
src/whitelist.php	Changes the whitelist source from $_SERVER to $_ENV when parsing WHITELIST.
tests/StatsTest.php	Updates whitelist-related tests to use $_ENV["WHITELIST"] when simulating the env var.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.