feat(auth): implement session token creation and verification for enhanced security

feat(api): require session authentication for admin routes and improve error handling

fix(api): streamline project image generation by fetching data directly from the database

fix(api): optimize project import/export functionality with session validation and improved error handling

fix(api): enhance analytics dashboard and email manager with session token for admin requests

fix(components): improve loading states and dynamic imports for better user experience

chore(security): update Content Security Policy to avoid unsafe-eval in production

chore(deps): update package.json scripts for consistent environment handling in linting and testing

app/api/projects/[id]/route.ts

@@ -1,7 +1,7 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { prisma } from '@/lib/prisma';
 import { apiCache } from '@/lib/cache';
-import { checkRateLimit, getRateLimitHeaders } from '@/lib/auth';
+import { checkRateLimit, getRateLimitHeaders, requireSessionAuth } from '@/lib/auth';
 import { PrismaClientKnownRequestError } from '@prisma/client/runtime/library';
 
 export async function GET(
@@ -11,6 +11,9 @@ export async function GET(
   try {
     const { id: idParam } = await params;
     const id = parseInt(idParam);
+    if (!Number.isFinite(id)) {
+      return NextResponse.json({ error: 'Invalid project id' }, { status: 400 });
+    }
     
     const project = await prisma.project.findUnique({
       where: { id }
@@ -74,9 +77,14 @@ export async function PUT(
         { status: 403 }
       );
     }
+    const authError = requireSessionAuth(request);
+    if (authError) return authError;
 
     const { id: idParam } = await params;
     const id = parseInt(idParam);
+    if (!Number.isFinite(id)) {
+      return NextResponse.json({ error: 'Invalid project id' }, { status: 400 });
+    }
     const data = await request.json();
     
     // Remove difficulty field if it exists (since we're removing it)
@@ -147,9 +155,14 @@ export async function DELETE(
         { status: 403 }
       );
     }
+    const authError = requireSessionAuth(request);
+    if (authError) return authError;
 
     const { id: idParam } = await params;
     const id = parseInt(idParam);
+    if (!Number.isFinite(id)) {
+      return NextResponse.json({ error: 'Invalid project id' }, { status: 400 });
+    }
     
     await prisma.project.delete({
       where: { id }