feat: integrate Sensei Spook mascot in 4 stances, speech bubbles, and style updates

lib/admin-auth.ts

@@ -0,0 +1,24 @@
+import { NextRequest } from "next/server";
+import crypto from "crypto";
+import { constantTimeCompare } from "@/lib/security";
+
+export function getExpectedToken(): string {
+  const secret = process.env.ADMIN_PASSWORD || "admin123";
+  if (!process.env.ADMIN_PASSWORD && process.env.NODE_ENV === "production") {
+    console.warn("[SECURITY WARNING] ADMIN_PASSWORD is not set in environment variables! Using insecure default.");
+  }
+  return crypto.createHash("sha256").update(`booth-portal-session-${secret}`).digest("hex");
+}
+
+export function isAuthenticated(req: NextRequest): boolean {
+  const cookieToken = req.cookies.get("booth_portal_token")?.value;
+  const authHeader = req.headers.get("authorization");
+  const bearerToken = authHeader?.startsWith("Bearer ") ? authHeader.substring(7) : null;
+
+  const expected = getExpectedToken();
+  const tokenToTest = cookieToken || bearerToken || "";
+
+  if (!tokenToTest) return false;
+
+  return constantTimeCompare(tokenToTest, expected);
+}