Initial commit: Pireon Admin — headless admin panel and public API

Laravel 13 + Filament 5 admin panel and REST API for a non-profit developer
collective, backed by the Pireon OAuth identity server. The public site is a
separate, server-rendered application consuming /api/public/v1.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

database/migrations/2026_08_13_150000_create_applications_table.php

@@ -0,0 +1,77 @@
+<?php
+
+declare(strict_types=1);
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * The inbox: everything the public site sends back.
+ *
+ * Until now the public API was read-only, so a call for contributors ended at
+ * "here is what we need" with nowhere for the reader to answer. This is the
+ * other half of the conversion point.
+ *
+ * Two kinds share one table because the handling is identical — somebody wrote
+ * in, somebody has to reply — and only the intent differs: offering time, or
+ * asking for it.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('applications', function (Blueprint $table) {
+            $table->id();
+
+            // Null for a general enquiry, and null again if the call is later
+            // deleted: a person who wrote in must not disappear because the
+            // opening they answered was tidied up.
+            $table->foreignId('call_id')->nullable()
+                ->constrained()->nullOnDelete();
+
+            // Snapshot of what they answered, so the record still reads
+            // correctly once the call is gone or its title is rewritten.
+            $table->string('call_title')->nullable();
+
+            $table->string('kind', 20)->default('contribute');
+            $table->string('status', 20)->default('new');
+
+            $table->string('name');
+            $table->string('email');
+            $table->string('organisation')->nullable();
+            $table->text('message');
+
+            // Mirrors the call's own ask, so the two numbers can be compared
+            // at a glance instead of hunting through the message.
+            $table->unsignedTinyInteger('hours_per_week')->nullable();
+            $table->jsonb('links')->nullable();
+
+            // The language they wrote in — reply in the same one.
+            $table->string('locale', 5)->default('es');
+
+            // Hashed, never raw: enough to recognise a flood coming from one
+            // source, without this table becoming a log of visitors' IPs.
+            $table->string('ip_hash', 64)->nullable();
+
+            // Internal side, invisible to the sender.
+            $table->text('notes')->nullable();
+            $table->foreignId('handled_by')->nullable()
+                ->constrained('users')->nullOnDelete();
+            $table->timestamp('handled_at')->nullable();
+
+            $table->timestamps();
+            $table->softDeletes();
+
+            // The inbox is read newest-unhandled-first, and deduplication
+            // looks up by email.
+            $table->index(['status', 'created_at']);
+            $table->index('email');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('applications');
+    }
+};