Toolvana: production-ready media tools platform (CodeIgniter 4)

- 134-tool registry with programmatic SEO (unique titles/H1/descriptions,
  JSON-LD graphs, sitemap index, canonical 301 enforcement via required filter)
- DB-backed job queue (SKIP LOCKED) with drivers: Ffmpeg, Images (GD),
  Pdf (qpdf/gs/poppler), Youtube (thumbnails), Qr (server-side PNG)
- Security: SSRF guard, MIME validation, rate limits, API-key auth,
  bcrypt admin login, security headers
- Admin panel: dashboard, tools/categories/guides CRUD, SEO audit,
  analytics, job inspector with retry, system health, feature flags
- Docker deployment (nginx + web/api FPM pools + scalable workers),
  PHPUnit suite (19 tests / 1139 assertions), PWA manifest + service worker

app/Filters/AdminAuth.php

@@ -0,0 +1,37 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filters;
+
+use CodeIgniter\Filters\FilterInterface;
+use CodeIgniter\HTTP\RequestInterface;
+use CodeIgniter\HTTP\ResponseInterface;
+
+/**
+ * Admin gate: single-operator password from .env (bcrypt), session
+ * flag, CSRF-protected login. Deliberately simple — swap for SSO or a
+ * users table later without touching routes (same filter alias).
+ */
+final class AdminAuth implements FilterInterface
+{
+    public function before(RequestInterface $request, $arguments = null)
+    {
+        // The login/logout pair is exempted in Filters::$filters config.
+        $uri = uri_string();
+        if ($uri === 'admin/login' || $uri === 'admin/auth/attempt') {
+            return null;
+        }
+
+        if (! session()->get('tv_admin_ok')) {
+            return redirect()->to('/admin/login');
+        }
+
+        return null;
+    }
+
+    public function after(RequestInterface $request, ResponseInterface $response, $arguments = null)
+    {
+        return null;
+    }
+}