feat: add City10 platform with Laravel 13, AI agents, 3D viewer, and LGPD compliance

Initial commit of the complete City10 virtual city simulation platform.

Backend (Laravel 13):
- REST API with Sanctum tokens and session-based web authentication
- Role-based access control (admin/user) with middleware protection
- AI agent CRUD with OpenRouter.ai integration restricted to free models
- Store management with 3D coordinates and AI shopkeeper assignment
- Versioned legal documents (Terms, Privacy, Cookies) with LGPD audit trail
- Math CAPTCHA on public forms and multi-language support (pt_BR, en, es)

Frontend:
- Responsive Blade templates with Tailwind CSS v4
- Three.js 3D city viewer with SSE chat streaming to AI agents
- Admin panel for store and user administration

Infrastructure:
- MariaDB/MySQL database with comprehensive migrations
- Database seeders for demo content and test accounts
- PHPUnit test suite and Laravel Pint code styling
- Vite build configuration with hot reload

app/Http/Middleware/EnsureTermsAccepted.php

@@ -0,0 +1,54 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Models\LegalDocument;
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Blocks access until the user accepted all current legal documents.
+ *
+ * Implements the LGPD requirement that the Terms of Use, Privacy Policy
+ * and Cookie Policy must be accepted on first access before the main
+ * platform features can be used.
+ */
+class EnsureTermsAccepted
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  Closure(Request): (Response)  $next
+     */
+    public function handle(Request $request, Closure $next): Response
+    {
+        $user = $request->user();
+
+        if ($user === null) {
+            return $next($request);
+        }
+
+        $currentIds = LegalDocument::query()->where('is_current', true)->pluck('id');
+
+        if ($currentIds->isEmpty()) {
+            return $next($request);
+        }
+
+        $acceptedIds = $user->consents()->pluck('legal_document_id');
+        $pending = $currentIds->diff($acceptedIds);
+
+        if ($pending->isNotEmpty()) {
+            if ($request->expectsJson()) {
+                return response()->json([
+                    'message' => __('legal.accept_required'),
+                    'pending' => $pending->values(),
+                ], 428);
+            }
+
+            return redirect()->route('terms.accept');
+        }
+
+        return $next($request);
+    }
+}

app/Http/Middleware/EnsureUserIsActive.php

@@ -0,0 +1,44 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Ensures the authenticated account is still active.
+ *
+ * Blocks disabled (deactivated) accounts from accessing any protected
+ * route, even when a previously issued token or session remains valid.
+ */
+class EnsureUserIsActive
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  Closure(Request): (Response)  $next
+     */
+    public function handle(Request $request, Closure $next): Response
+    {
+        $user = $request->user();
+
+        if ($user !== null && ! $user->is_active) {
+            if ($request->expectsJson()) {
+                return response()->json([
+                    'message' => __('auth.disabled'),
+                ], 403);
+            }
+
+            auth()->guard('web')->logout();
+            $request->session()->invalidate();
+            $request->session()->regenerateToken();
+
+            return redirect()->route('login')->withErrors([
+                'email' => __('auth.disabled'),
+            ]);
+        }
+
+        return $next($request);
+    }
+}

app/Http/Middleware/EnsureUserIsAdmin.php

@@ -0,0 +1,36 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Restricts access to platform administrators.
+ *
+ * Returns 403 for non-admin users, protecting the admin-only endpoints
+ * (user management, agent registry, store registry administration).
+ */
+class EnsureUserIsAdmin
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  Closure(Request): (Response)  $next
+     */
+    public function handle(Request $request, Closure $next): Response
+    {
+        $user = $request->user();
+
+        if ($user === null || ! $user->isAdmin()) {
+            if ($request->expectsJson()) {
+                return response()->json(['message' => __('auth.forbidden')], 403);
+            }
+
+            abort(403, __('auth.forbidden'));
+        }
+
+        return $next($request);
+    }
+}

app/Http/Middleware/SetLocale.php

@@ -0,0 +1,43 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\App;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Applies the visitor's preferred locale on each request.
+ *
+ * Reads the locale from the session (set at login or when the user switches
+ * language) or from the city10-locale cookie, falling back to the default.
+ * This keeps the whole interface in the language chosen by the user.
+ */
+class SetLocale
+{
+    /**
+     * Supported UI locales.
+     *
+     * @var list<string>
+     */
+    public const SUPPORTED = ['pt_BR', 'en', 'es'];
+
+    /**
+     * Handle an incoming request.
+     *
+     * @param  Closure(Request): (Response)  $next
+     */
+    public function handle(Request $request, Closure $next): Response
+    {
+        $locale = ($request->hasSession() ? $request->session()->get('locale') : null)
+            ?: $request->cookie('city10-locale')
+            ?: config('app.locale');
+
+        if (in_array($locale, self::SUPPORTED, true)) {
+            App::setLocale($locale);
+        }
+
+        return $next($request);
+    }
+}