Initial commit: Pireon Admin — headless admin panel and public API

Laravel 13 + Filament 5 admin panel and REST API for a non-profit developer
collective, backed by the Pireon OAuth identity server. The public site is a
separate, server-rendered application consuming /api/public/v1.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

bootstrap/app.php

@@ -0,0 +1,58 @@
+<?php
+
+declare(strict_types=1);
+
+use App\Http\Middleware\AllowPreview;
+use App\Http\Middleware\CachePublicResponse;
+use App\Http\Middleware\EnsureSiteIsAvailable;
+use App\Http\Middleware\SetLocale;
+use App\Http\Middleware\VerifyIngestToken;
+use Illuminate\Foundation\Application;
+use Illuminate\Foundation\Configuration\Exceptions;
+use Illuminate\Foundation\Configuration\Middleware;
+use Illuminate\Http\Request;
+use Spatie\Permission\Middleware\PermissionMiddleware;
+use Spatie\Permission\Middleware\RoleMiddleware;
+use Spatie\Permission\Middleware\RoleOrPermissionMiddleware;
+
+return Application::configure(basePath: dirname(__DIR__))
+    ->withRouting(
+        web: __DIR__.'/../routes/web.php',
+        api: __DIR__.'/../routes/api.php',
+        commands: __DIR__.'/../routes/console.php',
+        health: '/up',
+        apiPrefix: 'api',
+    )
+    ->withMiddleware(function (Middleware $middleware): void {
+        // Locale negotiation runs on both stacks: the panel needs it for the
+        // UI, the API for Accept-Language and translated payloads.
+        $middleware->web(append: [SetLocale::class]);
+        $middleware->api(append: [SetLocale::class]);
+
+        $middleware->alias([
+            'role' => RoleMiddleware::class,
+            'permission' => PermissionMiddleware::class,
+            'role_or_permission' => RoleOrPermissionMiddleware::class,
+
+            // Public API: HTTP caching for an SSR frontend, and the secret
+            // that lets it render unpublished content.
+            'cache.public' => CachePublicResponse::class,
+            'preview' => AllowPreview::class,
+
+            // The one public endpoint the frontend writes to on its own
+            // behalf, rather than on behalf of a visitor filling in a form.
+            'ingest' => VerifyIngestToken::class,
+
+            // Maintenance for the public site only — never for the panel.
+            'site.available' => EnsureSiteIsAvailable::class,
+        ]);
+
+        // Guests hitting a panel route get the "sign in with Pireon" page
+        // rather than Laravel's default /login form.
+        $middleware->redirectGuestsTo(fn (Request $request) => route('login'));
+    })
+    ->withExceptions(function (Exceptions $exceptions): void {
+        $exceptions->shouldRenderJsonWhen(
+            fn (Request $request) => $request->is('api/*') || $request->expectsJson(),
+        );
+    })->create();

bootstrap/cache/.gitignore

@@ -0,0 +1,2 @@
+*
+!.gitignore

bootstrap/providers.php

@@ -0,0 +1,11 @@
+<?php
+
+use App\Providers\AppServiceProvider;
+use App\Providers\AuthServiceProvider;
+use App\Providers\Filament\AdminPanelProvider;
+
+return [
+    AppServiceProvider::class,
+    AuthServiceProvider::class,
+    AdminPanelProvider::class,
+];