refactor: enhance security and performance in configuration and API routes

- Update Content Security Policy (CSP) in next.config.ts to avoid `unsafe-eval` in production, improving security against XSS attacks.
- Refactor API routes to enforce admin authentication and session validation, ensuring secure access to sensitive endpoints.
- Optimize analytics data retrieval by using database aggregation instead of loading all records into memory, improving performance and reducing memory usage.
- Implement session token creation and verification for better session management and security across the application.
- Enhance error handling and input validation in various API routes to ensure robustness and prevent potential issues.

components/AnalyticsDashboard.tsx

@@ -72,15 +72,16 @@ export function AnalyticsDashboard({ isAuthenticated }: AnalyticsDashboardProps)
     try {
       setLoading(true);
       setError(null);
+      const sessionToken = sessionStorage.getItem('admin_session_token') || '';
       
       // Add cache-busting parameter to ensure fresh data after reset
       const cacheBust = `?nocache=true&t=${Date.now()}`;
       const [analyticsRes, performanceRes] = await Promise.all([
         fetch(`/api/analytics/dashboard${cacheBust}`, {
-          headers: { 'x-admin-request': 'true' }
+          headers: { 'x-admin-request': 'true', 'x-session-token': sessionToken }
         }),
         fetch(`/api/analytics/performance${cacheBust}`, {
-          headers: { 'x-admin-request': 'true' }
+          headers: { 'x-admin-request': 'true', 'x-session-token': sessionToken }
         })
       ]);
 
@@ -128,11 +129,13 @@ export function AnalyticsDashboard({ isAuthenticated }: AnalyticsDashboardProps)
     setResetting(true);
     setError(null);
     try {
+      const sessionToken = sessionStorage.getItem('admin_session_token') || '';
       const response = await fetch('/api/analytics/reset', {
         method: 'POST',
         headers: {
           'Content-Type': 'application/json',
-          'x-admin-request': 'true'
+          'x-admin-request': 'true',
+          'x-session-token': sessionToken
         },
         body: JSON.stringify({ type: resetType })
       });