Initial commit: Pireon Admin — headless admin panel and public API

Laravel 13 + Filament 5 admin panel and REST API for a non-profit developer
collective, backed by the Pireon OAuth identity server. The public site is a
separate, server-rendered application consuming /api/public/v1.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app/Notifications/ReviewRequested.php

@@ -0,0 +1,91 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Notifications;
+
+use App\Models\User;
+use App\Support\ContentTypes;
+use App\Support\ReviewTarget;
+use Filament\Actions\Action;
+use Filament\Notifications\Notification as FilamentNotification;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Notifications\Notification;
+use Illuminate\Support\Collection;
+
+/**
+ * Somebody has finished something and cannot publish it themselves.
+ *
+ * The bell, and only the bell. A review is work for the collective rather than
+ * a message from outside, and the people it goes to are already in the panel —
+ * unlike an application from a stranger, which is the one thing here worth
+ * putting in somebody's inbox.
+ */
+class ReviewRequested extends Notification
+{
+    public function __construct(
+        public readonly Model $record,
+        public readonly ?string $note = null,
+        public readonly ?string $requestedBy = null,
+    ) {}
+
+    /**
+     * @return array<int, string>
+     */
+    public function via(object $notifiable): array
+    {
+        return ['database'];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function toDatabase(object $notifiable): array
+    {
+        return FilamentNotification::make()
+            ->title(__('panel.reviews.notification.title', [
+                'name' => $this->requestedBy ?? __('panel.revisions.system'),
+            ]))
+            ->body(trim(ContentTypes::title($this->record).($this->note ? " — {$this->note}" : '')))
+            ->icon('heroicon-o-hand-raised')
+            ->iconColor('warning')
+            ->actions([
+                Action::make('review')
+                    ->label(__('panel.reviews.actions.open'))
+                    ->url(ReviewTarget::url($this->record))
+                    ->markAsRead(),
+            ])
+            ->getDatabaseMessage();
+    }
+
+    /**
+     * Who is told.
+     *
+     * A named reviewer, when there is one. Otherwise everybody who could
+     * actually act on it — resolved through `can()` rather than a permission
+     * scope so super admins are included, since they hold no explicit
+     * permissions at all, only the gate that grants them everything.
+     *
+     * The person who asked is never told about their own request.
+     *
+     * @return Collection<int, User>
+     */
+    public static function recipients(Model $record): Collection
+    {
+        if ($record->reviewer_id !== null) {
+            return User::query()
+                ->whereKey($record->reviewer_id)
+                ->where('is_active', true)
+                ->get();
+        }
+
+        $permission = ReviewTarget::permission($record);
+
+        return User::query()
+            ->where('is_active', true)
+            ->whereKeyNot($record->review_requested_by)
+            ->get()
+            ->filter(fn (User $user) => $user->can($permission))
+            ->values();
+    }
+}