Initial commit: Pireon Admin — headless admin panel and public API

Laravel 13 + Filament 5 admin panel and REST API for a non-profit developer
collective, backed by the Pireon OAuth identity server. The public site is a
separate, server-rendered application consuming /api/public/v1.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app/Http/Middleware/VerifyIngestToken.php

@@ -0,0 +1,47 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Guards the endpoints the frontend writes to on its own behalf.
+ *
+ * Everything else under /api/public is either read-only or written by a
+ * visitor filling in a form. This is neither: it is one server talking to
+ * another, so it can hold a secret, and it should — an open write endpoint is
+ * an invitation to fill a table with someone else's idea of a URL.
+ *
+ * The secret travels in a header rather than the query string so it stays out
+ * of access logs. An unset token disables the endpoint rather than opening it,
+ * the same rule the preview secret follows.
+ */
+class VerifyIngestToken
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        $secret = (string) config('site.telemetry.token');
+
+        if (blank($secret)) {
+            return $this->refuse(__('site.telemetry.disabled'));
+        }
+
+        $presented = $request->header('X-Ingest-Token');
+
+        if (! is_string($presented) || ! hash_equals($secret, $presented)) {
+            return $this->refuse(__('site.telemetry.forbidden'));
+        }
+
+        return $next($request);
+    }
+
+    protected function refuse(string $message): Response
+    {
+        return response()->json(['message' => $message], Response::HTTP_FORBIDDEN)
+            ->header('Cache-Control', 'no-store, private');
+    }
+}