refactor: improve security, split routes, add API resources and FormRequests

- Fix timing attack vulnerability in AuthController
- Split web.php (316 lines) into 7 focused route files
- Add 8 API Resources for consistent response formatting
- Add 8 FormRequest classes for centralized validation
- Use Resources instead of manual array mapping in controllers

app/Http/Requests/Api/ArticleCommentRequest.php

@@ -0,0 +1,23 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\Api;
+
+use App\Rules\WebsiteWordfilterRule;
+use Illuminate\Foundation\Http\FormRequest;
+
+class ArticleCommentRequest extends FormRequest
+{
+    public function rules(): array
+    {
+        return [
+            'comment' => ['required', 'string', 'max:1000', new WebsiteWordfilterRule],
+        ];
+    }
+
+    public function authorize(): bool
+    {
+        return true;
+    }
+}

app/Http/Requests/Api/HelpTicketReplyRequest.php

@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\Api;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class HelpTicketReplyRequest extends FormRequest
+{
+    public function rules(): array
+    {
+        return [
+            'message' => ['required', 'string', 'max:5000'],
+        ];
+    }
+
+    public function authorize(): bool
+    {
+        return true;
+    }
+}

app/Http/Requests/Api/HelpTicketRequest.php

@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\Api;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class HelpTicketRequest extends FormRequest
+{
+    public function rules(): array
+    {
+        return [
+            'subject' => ['required', 'string', 'max:200'],
+            'category' => ['required', 'string', 'max:100'],
+            'message' => ['required', 'string', 'max:5000'],
+        ];
+    }
+
+    public function authorize(): bool
+    {
+        return true;
+    }
+}

app/Http/Requests/Api/LoginRequest.php

@@ -0,0 +1,23 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\Api;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class LoginRequest extends FormRequest
+{
+    public function rules(): array
+    {
+        return [
+            'username' => ['required', 'string'],
+            'password' => ['required'],
+        ];
+    }
+
+    public function authorize(): bool
+    {
+        return true;
+    }
+}

app/Http/Requests/Api/PhotoUploadRequest.php

@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\Api;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class PhotoUploadRequest extends FormRequest
+{
+    public function rules(): array
+    {
+        return [
+            'image' => ['required', 'image', 'max:5120'],
+        ];
+    }
+
+    public function authorize(): bool
+    {
+        return true;
+    }
+}

app/Http/Requests/Api/RegisterRequest.php

@@ -0,0 +1,26 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\Api;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class RegisterRequest extends FormRequest
+{
+    public function rules(): array
+    {
+        return [
+            'username' => ['required', 'string', 'max:50'],
+            'password' => ['required', 'string', 'min:6'],
+            'mail' => ['required', 'email', 'max:255'],
+            'look' => ['nullable', 'string'],
+            'motto' => ['nullable', 'string', 'max:100'],
+        ];
+    }
+
+    public function authorize(): bool
+    {
+        return true;
+    }
+}

app/Http/Requests/Api/UpdatePasswordRequest.php

@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\Api;
+
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rules\Password;
+
+class UpdatePasswordRequest extends FormRequest
+{
+    public function rules(): array
+    {
+        return [
+            'current_password' => ['required', 'current_password'],
+            'password' => ['required', 'string', 'min:6', 'confirmed'],
+        ];
+    }
+
+    public function authorize(): bool
+    {
+        return true;
+    }
+}

app/Http/Requests/Api/UpdateUserRequest.php

@@ -0,0 +1,23 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\Api;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class UpdateUserRequest extends FormRequest
+{
+    public function rules(): array
+    {
+        return [
+            'motto' => ['nullable', 'string', 'max:100'],
+            'look' => ['nullable', 'string'],
+        ];
+    }
+
+    public function authorize(): bool
+    {
+        return true;
+    }
+}