Add admin panel, gallery, and security hardening.

Replace forgeable cookie auth with signed JWT sessions, protect admin APIs, add input validation, and improve Docker deployment config.

src/lib/validation.ts

@@ -0,0 +1,24 @@
+import { z } from "zod";
+
+export const MAX_GPX_BYTES = 5 * 1024 * 1024; // 5 MB
+
+export const locationSchema = z.object({
+    title: z.string().trim().min(1, "Title is required").max(200),
+    city: z.string().trim().min(1, "City is required").max(200),
+    tags: z.string().max(500).default(""),
+    captureDate: z
+        .string()
+        .refine((d) => !isNaN(Date.parse(d)), "Invalid capture date"),
+    visibility: z.enum(["public", "unlisted"]).default("public"),
+    gpxData: z
+        .string()
+        .max(MAX_GPX_BYTES, `GPX data must be under ${MAX_GPX_BYTES / (1024 * 1024)} MB`)
+        .optional()
+        .nullable(),
+});
+
+export type LocationInput = z.infer<typeof locationSchema>;
+
+export function parseLocationBody(body: unknown) {
+    return locationSchema.safeParse(body);
+}