Challenge 2: A .htaccess File With Directives AllowOverride Doesn't
Permit — Solution Walkthrough

The specific real behavior:

The directory's AllowOverride is set to AuthConfig only, but the
.htaccess file's RewriteEngine/RewriteRule lines fall under FileInfo,
and its Options -Indexes line falls under the separate Options group
-- neither is covered by AuthConfig. When Apache processes a request
under that directory and reads a .htaccess file containing a
directive it isn't permitted to apply there, it doesn't quietly skip
just that one line and carry on with the rest. It logs an error
(something like "<directive> not allowed here" in the error log) and
returns an HTTP 500 Internal Server Error to the client for that
request.

Why this matters in practice:

This means a .htaccess file that was written for a directory with a
broader AllowOverride, then reused or copied into a directory with a
narrower one, doesn't degrade gracefully -- it breaks every request
to that directory outright with a 500, until either the file is
edited to only contain permitted directives or AllowOverride is
widened to cover what the file needs.

WHY THIS WORKS AS AN ANSWER
------------------------------
This exercise checks that the reader knows the actual observable
consequence of an AllowOverride/.htaccess mismatch -- a hard 500
error, not a silent partial application -- since assuming the wrong
one of these two very different failure modes leads to confusing,
hard-to-diagnose deployment problems in practice.