Toolvana: production-ready media tools platform (CodeIgniter 4)

- 134-tool registry with programmatic SEO (unique titles/H1/descriptions,
  JSON-LD graphs, sitemap index, canonical 301 enforcement via required filter)
- DB-backed job queue (SKIP LOCKED) with drivers: Ffmpeg, Images (GD),
  Pdf (qpdf/gs/poppler), Youtube (thumbnails), Qr (server-side PNG)
- Security: SSRF guard, MIME validation, rate limits, API-key auth,
  bcrypt admin login, security headers
- Admin panel: dashboard, tools/categories/guides CRUD, SEO audit,
  analytics, job inspector with retry, system health, feature flags
- Docker deployment (nginx + web/api FPM pools + scalable workers),
  PHPUnit suite (19 tests / 1139 assertions), PWA manifest + service worker

app/Controllers/Admin/Auth.php

@@ -0,0 +1,48 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Controllers\Admin;
+
+use App\Controllers\BaseController;
+use CodeIgniter\HTTP\ResponseInterface;
+
+/**
+ * Admin authentication: single operator password (bcrypt) from .env.
+ */
+final class Auth extends BaseController
+{
+    public function loginForm(): string
+    {
+        return $this->render('admin/login', ['error' => session()->getFlashdata('login_error')]);
+    }
+
+    public function attempt(): ResponseInterface
+    {
+        $password = (string) $this->request->getPost('password');
+        $hash     = (string) env('site.adminPassword', '');
+
+        if ($password === '' || ! password_verify($password, $hash)) {
+            sleep(1); // brute-force damping
+            session()->setFlashdata('login_error', 'Incorrect password.');
+            service('analytics')->track('error', ['meta' => ['scope' => 'admin_login_failed']]);
+
+            return redirect()->to('/admin/login')->withInput();
+        }
+
+        // rehash if algorithm cost changed
+        if (password_needs_rehash($hash, PASSWORD_DEFAULT)) {
+        }
+
+        session()->set(['tv_admin_ok' => true, 'tv_admin_at' => time()]);
+
+        return redirect()->to('/admin');
+    }
+
+    public function logout(): ResponseInterface
+    {
+        session()->remove('tv_admin_ok');
+
+        return redirect()->to('/admin/login');
+    }
+}