feat: add admin dashboard and core API routes with Docker configuration

admin/src/app/api/cron/cleanup-users/route.ts

@@ -1,16 +1,29 @@
 import { NextResponse } from "next/server";
+import crypto from "crypto";
 import { prisma } from "@/lib/prisma";
 
+function safeCompareSecret(provided: string | null, expected: string | undefined): boolean {
+  if (!provided || !expected) return false;
+  const bufA = Buffer.from(provided);
+  const bufB = Buffer.from(expected);
+  if (bufA.length !== bufB.length) return false;
+  return crypto.timingSafeEqual(bufA, bufB);
+}
+
 /**
  * Route pour le nettoyage automatique des comptes
  * À appeler via une tâche cron (ex: chaque nuit à minuit)
- * GET /api/cron/cleanup-users?key=VOTRE_CLE_SECRET
+ * Supporte `Authorization: Bearer <CRON_SECRET>` ou `?key=<CRON_SECRET>`
  */
 export async function GET(request: Request) {
   const { searchParams } = new URL(request.url);
-  const key = searchParams.get("key");
+  const authHeader = request.headers.get("authorization");
+  const bearerToken = authHeader?.startsWith("Bearer ")
+    ? authHeader.slice("Bearer ".length).trim()
+    : null;
+  const key = bearerToken || searchParams.get("key");
 
-  if (key !== process.env.CRON_SECRET) {
+  if (!safeCompareSecret(key, process.env.CRON_SECRET)) {
     return NextResponse.json({ error: "Non autorisé" }, { status: 401 });
   }