Initial commit: Pireon Admin — headless admin panel and public API

Laravel 13 + Filament 5 admin panel and REST API for a non-profit developer
collective, backed by the Pireon OAuth identity server. The public site is a
separate, server-rendered application consuming /api/public/v1.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app/Http/Requests/PublicApi/ReportMissingUrlRequest.php

@@ -0,0 +1,73 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\PublicApi;
+
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+/**
+ * What the frontend could not resolve.
+ *
+ * Two shapes are accepted, because both are natural on the other side: a
+ * single report, which is what one rendered 404 produces, and a batch, which
+ * is what a queue on the frontend flushes. The single form is folded into a
+ * batch of one before validation, so there is one code path from here on.
+ */
+class ReportMissingUrlRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        // The shared secret is the authorisation, and the middleware has
+        // already checked it.
+        return true;
+    }
+
+    /**
+     * Accept `{"path": "..."}` as `{"hits": [{"path": "..."}]}`.
+     */
+    protected function prepareForValidation(): void
+    {
+        if ($this->has('path') && ! $this->has('hits')) {
+            $this->merge(['hits' => [$this->only(['path', 'locale', 'referrer'])]]);
+        }
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function rules(): array
+    {
+        return [
+            'hits' => ['required', 'array', 'min:1', 'max:'.$this->maxBatch()],
+
+            // Paths, not URLs: the frontend knows its own origin, and a report
+            // carrying a full address would let a caller file a 404 against
+            // somebody else's domain.
+            'hits.*.path' => ['required', 'string', 'max:500', 'starts_with:/'],
+
+            'hits.*.locale' => [
+                'sometimes', 'nullable', 'string',
+                Rule::in(array_keys((array) config('locales.supported'))),
+            ],
+
+            // Where the visitor came from, verbatim from the Referer header,
+            // so it can be a URL on anybody's domain.
+            'hits.*.referrer' => ['sometimes', 'nullable', 'string', 'url:http,https', 'max:500'],
+        ];
+    }
+
+    /**
+     * @return array<int, array<string, string|null>>
+     */
+    public function hits(): array
+    {
+        return array_values((array) $this->validated('hits'));
+    }
+
+    public function maxBatch(): int
+    {
+        return max(1, (int) config('site.telemetry.max_batch', 50));
+    }
+}