feat: full site build — Project/Melody schema (Option A), admin CRUD, public sections, uploads, email+SMTP, internal analytics, legal pages, docs

app/api/analytics/route.ts

@@ -0,0 +1,19 @@
+import { NextResponse } from "next/server";
+import { headers } from "next/headers";
+import { recordAnalyticsEvent } from "@/lib/analytics";
+import { consumeRateLimit, getClientIp } from "@/lib/rate-limit";
+
+export async function POST(request: Request) {
+  const ip = getClientIp(headers());
+  if (!consumeRateLimit(`analytics:${ip}`, 60, 60 * 1000)) {
+    return NextResponse.json({ error: "rate-limited" }, { status: 429 });
+  }
+
+  try {
+    const input = await request.json();
+    const recorded = await recordAnalyticsEvent(input);
+    return recorded ? new NextResponse(null, { status: 204 }) : NextResponse.json({ error: "invalid-event" }, { status: 400 });
+  } catch {
+    return NextResponse.json({ error: "invalid-request" }, { status: 400 });
+  }
+}