feat: add authenticated Docker deployment

proxy.ts

@@ -0,0 +1,33 @@
+import { timingSafeEqual } from "node:crypto";
+import { NextRequest, NextResponse } from "next/server";
+
+function sameValue(left: string, right: string) {
+  const leftBuffer = Buffer.from(left);
+  const rightBuffer = Buffer.from(right);
+  return leftBuffer.length === rightBuffer.length && timingSafeEqual(leftBuffer, rightBuffer);
+}
+
+export function proxy(request: NextRequest) {
+  if (request.nextUrl.pathname === "/api/health") return NextResponse.next();
+
+  const password = process.env.STUDIO_PASSWORD;
+  const username = process.env.STUDIO_USERNAME || "studio";
+  if (!password) {
+    if (process.env.NODE_ENV !== "production") return NextResponse.next();
+    return NextResponse.json({ error: "STUDIO_PASSWORD is not configured" }, { status: 503 });
+  }
+
+  const authorization = request.headers.get("authorization") || "";
+  const expected = `Basic ${Buffer.from(`${username}:${password}`).toString("base64")}`;
+  if (!sameValue(authorization, expected)) {
+    return new NextResponse("Authentication required", {
+      status: 401,
+      headers: { "WWW-Authenticate": 'Basic realm="Rednote Tool Studio", charset="UTF-8"' },
+    });
+  }
+  return NextResponse.next();
+}
+
+export const config = {
+  matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"],
+};