Initial commit: Pireon Admin — headless admin panel and public API

Laravel 13 + Filament 5 admin panel and REST API for a non-profit developer
collective, backed by the Pireon OAuth identity server. The public site is a
separate, server-rendered application consuming /api/public/v1.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docker/Caddyfile

@@ -0,0 +1,53 @@
+{
+	# The panel is the only thing served, and it is behind a login: no reason
+	# for the server to announce its version to anybody scanning.
+	frankenphp
+	order php_server before file_server
+	auto_https off
+	servers {
+		trusted_proxies static private_ranges
+	}
+}
+
+{$SERVER_NAME:-:80} {
+	root * /app/public
+
+	encode zstd gzip
+
+	# Uploaded images. `public/storage` is a symlink into the storage volume,
+	# so this is what actually serves what the collective uploads — and it is
+	# the one path an SSR frontend fetches on every page view, so it is cached
+	# hard and never touched by PHP.
+	@media path /storage/*
+	header @media Cache-Control "public, max-age=31536000, immutable"
+
+	# The frontend is a separate application on another origin.
+	@api path /api/*
+	header @api {
+		X-Content-Type-Options nosniff
+	}
+
+	header {
+		X-Content-Type-Options nosniff
+		X-Frame-Options SAMEORIGIN
+		Referrer-Policy strict-origin-when-cross-origin
+		-Server
+	}
+
+	php_server {
+		# Laravel's own health route, so the container can be probed without
+		# touching the database.
+		try_files {path} /index.php
+	}
+
+	# The health probe runs every 30 seconds and would otherwise be most of
+	# the access log. `log_skip` is the directive for this — `exclude` inside
+	# `log` is not valid in Caddy 2.
+	@health path /up
+	log_skip @health
+
+	log {
+		output stdout
+		format json
+	}
+}