Initial import: property management SaaS + security hardening + admin dashboard

Property Management Network — Next.js 16 (App Router), Better Auth,
Drizzle ORM over PostgreSQL, Stripe, OpenAI, Resend.

Includes:
- Security hardening: access-control/IDOR fixes, TLS-by-default DB layer,
  constant-time cron auth, strict security headers, atomic AI quota gating,
  HTML/email output encoding, demo-backdoor disabled in production.
- Superadmin dashboard at /admin (overview/MRR, server-paginated users with
  ban/impersonate/plan/delete, billing, platform activity + admin audit log,
  AI usage, system health) via the Better Auth admin plugin.
- Seed/migration utility scripts under scripts/.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

next.config.ts

@@ -0,0 +1,48 @@
+import type { NextConfig } from "next";
+
+// Pragmatic baseline Content-Security-Policy for a Next.js app.
+// NOTE: Next 16 commonly needs 'unsafe-inline' for styles/scripts when no
+// nonce pipeline is configured. Tightening this to per-request nonces
+// (removing 'unsafe-inline') is a recommended follow-up.
+const contentSecurityPolicy = [
+  "default-src 'self'",
+  "img-src 'self' data: blob: https:",
+  "style-src 'self' 'unsafe-inline'",
+  "script-src 'self' 'unsafe-inline'",
+  "font-src 'self' data:",
+  "connect-src 'self' https://api.stripe.com https://api.openai.com https://api.resend.com",
+  "frame-src https://js.stripe.com https://hooks.stripe.com",
+  "frame-ancestors 'none'",
+  "base-uri 'self'",
+  "form-action 'self'",
+].join("; ");
+
+const nextConfig: NextConfig = {
+  // Emit a self-contained server bundle at .next/standalone so the Docker
+  // image (used by Coolify) ships only the files needed to run `node server.js`.
+  output: "standalone",
+
+  // Strict security headers applied to every route.
+  async headers() {
+    return [
+      {
+        source: "/(.*)",
+        headers: [
+          { key: "X-Content-Type-Options", value: "nosniff" },
+          { key: "X-Frame-Options", value: "DENY" },
+          // no-referrer prevents the tenant-portal token (carried in the URL)
+          // from leaking to third parties via the Referer header.
+          { key: "Referrer-Policy", value: "no-referrer" },
+          {
+            key: "Strict-Transport-Security",
+            value: "max-age=63072000; includeSubDomains; preload",
+          },
+          { key: "X-DNS-Prefetch-Control", value: "off" },
+          { key: "Content-Security-Policy", value: contentSecurityPolicy },
+        ],
+      },
+    ];
+  },
+};
+
+export default nextConfig;