Initial commit: Pireon Admin — headless admin panel and public API

Laravel 13 + Filament 5 admin panel and REST API for a non-profit developer
collective, backed by the Pireon OAuth identity server. The public site is a
separate, server-rendered application consuming /api/public/v1.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.env.example

@@ -0,0 +1,188 @@
+APP_NAME="Pireon Admin"
+APP_ENV=local
+APP_KEY=
+APP_DEBUG=true
+APP_URL=http://localhost:8000
+
+APP_LOCALE=es
+APP_FALLBACK_LOCALE=es
+APP_FAKER_LOCALE=es_ES
+
+APP_MAINTENANCE_DRIVER=file
+# APP_MAINTENANCE_STORE=database
+
+# PHP_CLI_SERVER_WORKERS=4
+
+BCRYPT_ROUNDS=12
+
+LOG_CHANNEL=stack
+LOG_STACK=single
+LOG_DEPRECATIONS_CHANNEL=null
+LOG_LEVEL=debug
+
+DB_CONNECTION=sqlite
+# DB_HOST=127.0.0.1
+# DB_PORT=3306
+# DB_DATABASE=laravel
+# DB_USERNAME=root
+# DB_PASSWORD=
+
+SESSION_DRIVER=database
+SESSION_LIFETIME=120
+SESSION_ENCRYPT=false
+SESSION_PATH=/
+SESSION_DOMAIN=null
+
+BROADCAST_CONNECTION=log
+FILESYSTEM_DISK=local
+QUEUE_CONNECTION=database
+
+CACHE_STORE=database
+# CACHE_PREFIX=
+
+MEMCACHED_HOST=127.0.0.1
+
+REDIS_CLIENT=phpredis
+REDIS_HOST=127.0.0.1
+REDIS_PASSWORD=null
+REDIS_PORT=6379
+
+MAIL_MAILER=log
+MAIL_SCHEME=null
+MAIL_HOST=127.0.0.1
+MAIL_PORT=2525
+MAIL_USERNAME=null
+MAIL_PASSWORD=null
+MAIL_FROM_ADDRESS="hello@example.com"
+MAIL_FROM_NAME="${APP_NAME}"
+
+AWS_ACCESS_KEY_ID=
+AWS_SECRET_ACCESS_KEY=
+AWS_DEFAULT_REGION=us-east-1
+AWS_BUCKET=
+AWS_USE_PATH_STYLE_ENDPOINT=false
+
+VITE_APP_NAME="${APP_NAME}"
+
+###############################################################################
+# Pireon OAuth2 identity server
+#
+# Register this app as an OAuth client at https://oauth.pireon.dev and paste the
+# credentials here. The redirect URI must match the one registered there exactly.
+###############################################################################
+PIREON_SERVER=https://oauth.pireon.dev
+PIREON_CLIENT_ID=
+PIREON_CLIENT_SECRET=
+PIREON_REDIRECT_URI="${APP_URL}/auth/callback"
+PIREON_SCOPES=account:read
+
+# Grants. The panel's sign-in form uses the password grant, so turning this off
+# locks everyone out of the panel as well as out of POST /api/v1/auth/token.
+PIREON_PASSWORD_GRANT=true
+
+# How long an API bearer token stays valid here after being revoked upstream.
+PIREON_INTROSPECTION_TTL=60
+PIREON_HTTP_TIMEOUT=10
+
+# Role granted on a user's first sign-in.
+PIREON_DEFAULT_ROLE=viewer
+
+# Refuse sessions for accounts the identity server reports as inactive or
+# still awaiting administrator approval.
+PIREON_REQUIRE_ACTIVE=true
+PIREON_REQUIRE_APPROVED=true
+
+###############################################################################
+# Public site (separate, server-rendered application)
+###############################################################################
+SITE_URL=http://localhost:4321
+
+# Frontend i18n routers serve the default locale without a prefix. Turn this
+# on only if yours prefixes every locale.
+SITE_PREFIX_DEFAULT_LOCALE=false
+
+# Shared secret letting the frontend render unpublished content.
+# Leave empty to disable previews entirely. Generate one with:
+#   php -r "echo bin2hex(random_bytes(24)), PHP_EOL;"
+SITE_PREVIEW_TOKEN=
+
+# Seconds a shared cache may serve a public response without revalidating.
+SITE_CACHE_SECONDS=60
+
+# Requests per minute on the public API. With SSR every visitor's page view
+# arrives from the frontend's IP, so this is a budget for the WHOLE site at
+# once. Add that IP to SITE_TRUSTED_IPS to bypass the limit entirely.
+SITE_RATE_LIMIT=600
+SITE_TRUSTED_IPS=
+
+# Shared secret the frontend presents when reporting addresses it could not
+# resolve (X-Ingest-Token). Those reports are what turns Redirects from
+# something only this side can write into a list of links actually broken out
+# there. Leave empty to disable the endpoint — empty never means "anyone may
+# report". Generate one with:
+#   php -r "echo bin2hex(random_bytes(24)), PHP_EOL;"
+SITE_INGEST_TOKEN=
+
+# Reports per minute, and paths per request.
+SITE_TELEMETRY_RATE_LIMIT=60
+SITE_TELEMETRY_MAX_BATCH=50
+
+# Submissions — the only public write endpoints. Set to false to close the
+# forms without deploying; the frontend reads the flag from /site and hides
+# them rather than showing a form that would be refused.
+SITE_ACCEPT_SUBMISSIONS=true
+
+# Field name no human fills in. Anything arriving with it set is filed as
+# spam — filed, not dropped, so a browser autofill cannot lose a real message.
+SITE_HONEYPOT_FIELD=website
+
+# Per e-mail address, per minute; and across the whole site, per hour. There is
+# deliberately no per-IP budget: with SSR every submission arrives from the
+# frontend's address.
+SITE_SUBMISSION_RATE_LIMIT=3
+SITE_SUBMISSION_HOURLY_LIMIT=60
+SITE_SUBMISSION_DEDUPE_MINUTES=1440
+
+# Also e-mail the panel users who can read the inbox (needs a working mailer).
+SITE_SUBMISSION_MAIL=false
+
+###############################################################################
+# Images
+###############################################################################
+# Disk uploads live on. It has to be one with public URLs: the frontend is a
+# separate application on another host. `public` needs `php artisan storage:link`
+# once. If you have uploads from before this setting existed they are on the
+# private `local` disk — either move them to storage/app/public or set this to
+# `local`, which is served through the application's own /storage route.
+MEDIA_DISK=public
+
+# Images above this many pixels are recorded with their dimensions but not
+# resampled: resizing one costs more memory than it is worth, and it is nearly
+# always a mistake rather than an intention.
+MEDIA_MAX_PIXELS=50000000
+
+###############################################################################
+# Git repositories — self-hosted Gitea
+###############################################################################
+GIT_PROVIDER=gitea
+
+# Instance root, WITHOUT /api/v1 — the driver appends it.
+GITEA_URL=https://git.example.org
+
+# Only needed for private repositories, or if the instance requires sign-in to
+# read. Gitea → Settings → Applications. Narrowest useful scopes:
+# read:repository, read:issue.
+GITEA_TOKEN=
+
+# Organisation used when a repository is entered as a bare name.
+GITEA_ORG=
+
+# Optional: only for mirrors or the odd repository hosted on GitHub.
+GITHUB_TOKEN=
+GITHUB_ORG=
+
+# hourly | daily | or a raw cron expression
+GIT_SYNC_CRON=hourly
+GIT_SYNC_TTL=55
+GIT_MAX_ISSUES=25
+GIT_HTTP_TIMEOUT=15