feat: add admin dashboard and core API routes with Docker configuration

app/api/auth/login/route.ts

@@ -3,6 +3,7 @@ import prisma from '@/lib/prisma';
 import bcrypt from 'bcryptjs';
 
 import { verifyCsrfToken, verifyOrigin } from '@/lib/csrf';
+import { signUserToken, setUserSessionCookie } from '@/lib/auth-utils';
 
 export async function POST(request: NextRequest) {
     // CSRF Protection
@@ -75,11 +76,34 @@ export async function POST(request: NextRequest) {
             );
         }
 
-        // Omit password from response
-        const { password: _, ...userWithoutPassword } = user;
+        // Sign and set HttpOnly session cookie
+        const token = await signUserToken({
+            userId: user.id,
+            email: user.email,
+            role: user.role,
+        });
+        await setUserSessionCookie(token);
+
+        // Return only safe user fields (never leak password, resetToken, verificationToken)
+        const safeUser = {
+            id: user.id,
+            name: user.name,
+            email: user.email,
+            role: user.role,
+            avatar: user.avatar,
+            bio: user.bio,
+            location: user.location,
+            phone: user.phone,
+            countryId: user.countryId,
+            isSuspended: user.isSuspended,
+            suspensionReason: user.suspensionReason,
+            emailVerified: user.emailVerified,
+            createdAt: user.createdAt,
+            updatedAt: user.updatedAt,
+        };
 
         return NextResponse.json(
-            { message: 'Connexion réussie', user: userWithoutPassword },
+            { message: 'Connexion réussie', user: safeUser },
             { status: 200 }
         );