Harden auth, payments, and frontend against review findings.

Close exploitable gaps in booking/payment flows, enforce token versioning and account checks, gate sensitive payment data, and add middleware plus input validation across admin routes.

Co-authored-by: Cursor <cursoragent@cursor.com>

frontend/src/middleware.ts

@@ -0,0 +1,27 @@
+import { NextRequest, NextResponse } from 'next/server';
+
+/**
+ * Defense-in-depth guard for authenticated areas.
+ *
+ * Auth tokens live in localStorage (not readable here), so we rely on a lightweight
+ * `spanglish-auth` cookie set alongside login. The API remains the authoritative gate;
+ * this only keeps unauthenticated visitors from loading the admin/dashboard JS shell.
+ */
+export function middleware(request: NextRequest) {
+  const { pathname } = request.nextUrl;
+
+  if (pathname.startsWith('/admin') || pathname.startsWith('/dashboard')) {
+    const hasAuthCookie = request.cookies.get('spanglish-auth')?.value === '1';
+    if (!hasAuthCookie) {
+      const loginUrl = new URL('/login', request.url);
+      loginUrl.searchParams.set('redirect', pathname);
+      return NextResponse.redirect(loginUrl);
+    }
+  }
+
+  return NextResponse.next();
+}
+
+export const config = {
+  matcher: ['/admin/:path*', '/dashboard/:path*'],
+};