feat: add admin dashboard and core API routes with Docker configuration

lib/utils.ts

@@ -11,3 +11,28 @@ export function generateSlug(text: string): string {
     .replace(/^-+/, '') // trim - from start of text
     .replace(/-+$/, ''); // trim - from end of text
 }
+
+/**
+ * Validates external or relative URLs to prevent javascript:/data:/vbscript: XSS in href attributes.
+ */
+export function safeUrl(url?: string | null): string {
+  if (!url || typeof url !== 'string') return '#';
+  const trimmed = url.trim();
+  if (!trimmed) return '#';
+
+  // Allow safe relative paths (starting with single `/` and not `//` or `/\`)
+  if (trimmed.startsWith('/') && !trimmed.startsWith('//') && !trimmed.startsWith('/\\')) {
+    return trimmed;
+  }
+
+  try {
+    const parsed = new URL(trimmed);
+    if (parsed.protocol === 'http:' || parsed.protocol === 'https:') {
+      return parsed.toString();
+    }
+  } catch {
+    // Invalid URL
+  }
+
+  return '#';
+}