Add admin panel, gallery, and security hardening.

Replace forgeable cookie auth with signed JWT sessions, protect admin APIs, add input validation, and improve Docker deployment config.

src/app/api/config/route.ts

@@ -0,0 +1,9 @@
+import { NextResponse } from "next/server";
+
+export const dynamic = "force-dynamic";
+
+export async function GET() {
+    return NextResponse.json({
+        apiKey: process.env.GOOGLE_MAPS_API_KEY || "",
+    });
+}