feat: complete v0.5 operations foundation

app/api/admin/moderate/route.ts

@@ -0,0 +1,21 @@
+import { NextResponse } from "next/server";
+import { requireUser } from "@/lib/auth";
+import { db } from "@/lib/db";
+import { externalUrl } from "@/lib/http";
+import { requireSameOrigin } from "@/lib/security";
+import bcrypt from "bcryptjs";
+
+export async function POST(request: Request) {
+  try {
+    requireSameOrigin(request); const admin = await requireUser(); if (admin.role !== "admin") throw new Error("Forbidden");
+    const form = await request.formData(); const action = String(form.get("action")); const id = Number(form.get("id"));
+    if (action === "hide-post") { db.prepare("UPDATE posts SET hidden=1,updated_at=CURRENT_TIMESTAMP WHERE id=?").run(id); db.prepare("UPDATE reports SET resolved=1 WHERE post_id=?").run(id); }
+    else if (action === "restore-post") db.prepare("UPDATE posts SET hidden=0,updated_at=CURRENT_TIMESTAMP WHERE id=?").run(id);
+    else if (action === "disable-user") { if (id === admin.id) throw new Error("Cannot disable yourself"); db.prepare("UPDATE users SET disabled=1 WHERE id=?").run(id); }
+    else if (action === "enable-user") db.prepare("UPDATE users SET disabled=0 WHERE id=?").run(id);
+    else if (action === "reset-password") { const password = String(form.get("password") || ""); if (password.length < 10) throw new Error("Invalid password"); db.prepare("UPDATE users SET password_hash=? WHERE id=?").run(await bcrypt.hash(password, 12), id); }
+    else if (action === "resolve-report") db.prepare("UPDATE reports SET resolved=1 WHERE id=?").run(id);
+    else throw new Error("Invalid action");
+    return NextResponse.redirect(externalUrl(request, "/admin?updated=1"));
+  } catch { return NextResponse.redirect(externalUrl(request, "/admin?error=moderation")); }
+}