elseif (isset($_COOKIE['lang']) && in_array($_COOKIE['lang'], $supported_langs)) {
    $lang = $_COOKIE['lang'];
    $_SESSION['lang'] = $lang;
}
// 5. IP geo-location
else {
    $country_to_lang = [
        // Arabic countries
        'SA' => 'ar', 'AE' => 'ar', 'EG' => 'ar', 'IQ' => 'ar', 'JO' => 'ar',
        'KW' => 'ar', 'LB' => 'ar', 'LY' => 'ar', 'MA' => 'ar', 'OM' => 'ar',
        'QA' => 'ar', 'SD' => 'ar', 'SY' => 'ar', 'TN' => 'ar', 'YE' => 'ar',
        'BH' => 'ar', 'DZ' => 'ar', 'PS' => 'ar', 'MR' => 'ar', 'SO' => 'ar',
        'DJ' => 'ar', 'KM' => 'ar',
        // French
        'FR' => 'fr', 'BE' => 'fr', 'CH' => 'fr', 'LU' => 'fr', 'MC' => 'fr',
        'CA' => 'fr', 'NE' => 'fr', 'CI' => 'fr', 'SN' => 'fr', 'ML' => 'fr',
        'BF' => 'fr', 'TG' => 'fr', 'BJ' => 'fr', 'MG' => 'fr', 'CG' => 'fr',
        'CD' => 'fr', 'CM' => 'fr', 'TD' => 'fr', 'HT' => 'fr',
        // German
        'DE' => 'de', 'AT' => 'de', 'LI' => 'de',
        // Spanish
        'ES' => 'es', 'MX' => 'es', 'AR' => 'es', 'CO' => 'es', 'CL' => 'es',
        'PE' => 'es', 'EC' => 'es', 'CU' => 'es', 'BO' => 'es', 'PY' => 'es',
        'UY' => 'es', 'CR' => 'es', 'PA' => 'es', 'GT' => 'es', 'SV' => 'es',
        'DO' => 'es', 'HN' => 'es', 'NI' => 'es', 'PR' => 'es',
        // Turkish
        'TR' => 'tr', 'CY' => 'tr', 'AZ' => 'tr', 'UZ' => 'tr', 'KZ' => 'tr',
        'TM' => 'tr', 'KG' => 'tr',
        // Russian
        'RU' => 'ru', 'BY' => 'ru', 'UA' => 'ru', 'KZ' => 'ru', 'UZ' => 'ru',
        'GE' => 'ru', 'AM' => 'ru',
        // Default: English for everything else
    ];
    $country_code = '';
    $ip = $_SERVER['REMOTE_ADDR'] ?? '';
    if ($ip && $ip !== '127.0.0.1' && $ip !== '::1') {
        $ctx = stream_context_create(['http' => ['timeout' => 3]]);
        $geo = @file_get_contents("http://ip-api.com/json/{$ip}?fields=countryCode", false, $ctx);
        if ($geo) {
            $data = json_decode($geo, true);
            $country_code = $data['countryCode'] ?? '';
        }
    }
    if ($country_code && isset($country_to_lang[$country_code])) {
        $lang = $country_to_lang[$country_code];
        $_SESSION['lang'] = $lang;
        setcookie('sltv_lang', $lang, time() + 365*86400, '/');
    }
    // 6. Browser Accept-Language
    if (!$country_code || !isset($country_to_lang[$country_code])) {
        $accept = $_SERVER['HTTP_ACCEPT_LANGUAGE'] ?? 'en';
        $langs = explode(',', $accept);
        $detected = substr($langs[0], 0, 2);
        if (in_array($detected, ['en','ar','fr','de','es','tr','ru'])) {
            $lang = $detected;
        }