feat: add admin dashboard and core API routes with Docker configuration

app/api/users/route.ts

@@ -1,8 +1,9 @@
 import { NextRequest, NextResponse } from 'next/server'
+import bcrypt from 'bcryptjs'
 import prisma from '@/lib/prisma'
 import { isAdmin, USER_SAFE_SELECT } from '@/lib/auth-utils'
 
-// GET /api/users
+// GET /api/users (Admin only)
 export async function GET(request: NextRequest) {
     try {
         if (!(await isAdmin(request))) {
@@ -23,7 +24,7 @@ export async function GET(request: NextRequest) {
     }
 }
 
-// POST /api/users (Admin only)
+// POST /api/users (Admin only — hashes password and whitelists fields)
 export async function POST(request: NextRequest) {
     try {
         if (!(await isAdmin(request))) {
@@ -31,12 +32,33 @@ export async function POST(request: NextRequest) {
         }
 
         const body = await request.json()
-        
-        // Note: For admins, we might want to allow creating users directly, 
-        // but we should still ensure password hashing if provided.
-        // For now, we just restrict it to admins to prevent the public leak.
+        const email = body.email?.toLowerCase().trim()
+        const name = body.name?.trim()
+        const rawPassword = body.password
+
+        if (!email || !name || !rawPassword || rawPassword.length < 8) {
+            return NextResponse.json(
+                { error: 'Nom, email et mot de passe (min. 8 caractères) requis' },
+                { status: 400 }
+            )
+        }
+
+        const hashedPassword = await bcrypt.hash(rawPassword, 10)
+        const allowedRole = ['VISITOR', 'ENTREPRENEUR', 'ADMIN'].includes(body.role)
+            ? body.role
+            : 'VISITOR'
+
         const user = await prisma.user.create({ 
-            data: body,
+            data: {
+                name,
+                email,
+                password: hashedPassword,
+                role: allowedRole,
+                phone: body.phone || null,
+                bio: body.bio || null,
+                location: body.location || null,
+                emailVerified: true,
+            },
             select: USER_SAFE_SELECT
         })
         return NextResponse.json(user, { status: 201 })