Initial Ladill Frontdesk release with deploy pipeline.

Visitor management app with SSO, kiosk, badges, reports, and Gitea CI deploy to frontdesk.ladill.com.

Co-authored-by: Cursor <cursoragent@cursor.com>

routes/api.php

@@ -0,0 +1,29 @@
+<?php
+
+use App\Http\Controllers\Api\DeviceHeartbeatController;
+use App\Http\Controllers\Api\VisitController;
+use App\Http\Controllers\Api\VisitorController;
+use Illuminate\Support\Facades\Route;
+
+/*
+|--------------------------------------------------------------------------
+| Ladill Frontdesk — internal service API
+|--------------------------------------------------------------------------
+| Authenticated with per-consumer service keys (Authorization: Bearer
+| <FRONTDESK_API_KEY_*>) via auth.service:frontdesk. Scoped with ?owner=
+| (platform user public_id / OIDC sub).
+*/
+
+Route::post('devices/heartbeat', DeviceHeartbeatController::class)->middleware('throttle:device-heartbeat')->name('devices.heartbeat');
+Route::post('kiosk/offline-sync', [\App\Http\Controllers\Api\OfflineSyncController::class, 'store'])->middleware('throttle:kiosk-device')->name('kiosk.offline-sync');
+
+Route::middleware('auth.service:frontdesk')->group(function () {
+    Route::apiResource('visits', VisitController::class)->only(['index', 'store', 'show']);
+    Route::post('visits/{visit}/checkout', [VisitController::class, 'checkOut'])->name('visits.checkout');
+    Route::post('visits/{visit}/activate', [VisitController::class, 'activate'])->name('visits.activate');
+    Route::post('visits/{visit}/approve', [VisitController::class, 'approve'])->name('visits.approve');
+    Route::post('visits/{visit}/cancel', [VisitController::class, 'cancel'])->name('visits.cancel');
+
+    Route::get('visitors', [VisitorController::class, 'index'])->name('visitors.index');
+    Route::get('visitors/{visitor}', [VisitorController::class, 'show'])->name('visitors.show');
+});