feat: add admin dashboard and core API routes with Docker configuration

app/api/gemini/route.ts

@@ -1,9 +1,43 @@
 import { NextRequest, NextResponse } from 'next/server'
 import { GoogleGenAI } from '@google/genai'
+import { getAuthUser } from '@/lib/auth-utils'
+
+const RATE_LIMIT_WINDOW_MS = 60 * 1000 // 1 minute
+const MAX_REQUESTS_PER_WINDOW = 10
+const rateLimitMap = new Map<string, { count: number; resetAt: number }>()
+
+function checkRateLimit(key: string): boolean {
+    const now = Date.now()
+    const entry = rateLimitMap.get(key)
+    if (!entry || now > entry.resetAt) {
+        rateLimitMap.set(key, { count: 1, resetAt: now + RATE_LIMIT_WINDOW_MS })
+        return true
+    }
+    if (entry.count >= MAX_REQUESTS_PER_WINDOW) {
+        return false
+    }
+    entry.count += 1
+    return true
+}
 
 // POST /api/gemini — AI content generation
 export async function POST(request: NextRequest) {
     try {
+        const authUser = await getAuthUser(request)
+        if (!authUser) {
+            return NextResponse.json(
+                { error: 'Authentification requise' },
+                { status: 401 }
+            )
+        }
+
+        if (!checkRateLimit(authUser.id)) {
+            return NextResponse.json(
+                { error: 'Trop de requêtes IA. Veuillez patienter une minute.' },
+                { status: 429 }
+            )
+        }
+
         const apiKey = process.env.GEMINI_API_KEY
         if (!apiKey || apiKey === 'PLACEHOLDER_API_KEY') {
             return NextResponse.json(
@@ -14,7 +48,10 @@ export async function POST(request: NextRequest) {
 
         const ai = new GoogleGenAI({ apiKey })
         const body = await request.json()
-        const { action, name, category, keywords } = body
+        const action = typeof body.action === 'string' ? body.action : ''
+        const name = typeof body.name === 'string' ? body.name.trim().slice(0, 100) : ''
+        const category = typeof body.category === 'string' ? body.category.trim().slice(0, 100) : ''
+        const keywords = typeof body.keywords === 'string' ? body.keywords.trim().slice(0, 300) : ''
 
         if (action === 'description') {
             const prompt = `