feat: add City10 platform with Laravel 13, AI agents, 3D viewer, and LGPD compliance

Initial commit of the complete City10 virtual city simulation platform.

Backend (Laravel 13):
- REST API with Sanctum tokens and session-based web authentication
- Role-based access control (admin/user) with middleware protection
- AI agent CRUD with OpenRouter.ai integration restricted to free models
- Store management with 3D coordinates and AI shopkeeper assignment
- Versioned legal documents (Terms, Privacy, Cookies) with LGPD audit trail
- Math CAPTCHA on public forms and multi-language support (pt_BR, en, es)

Frontend:
- Responsive Blade templates with Tailwind CSS v4
- Three.js 3D city viewer with SSE chat streaming to AI agents
- Admin panel for store and user administration

Infrastructure:
- MariaDB/MySQL database with comprehensive migrations
- Database seeders for demo content and test accounts
- PHPUnit test suite and Laravel Pint code styling
- Vite build configuration with hot reload

routes/api.php

@@ -0,0 +1,76 @@
+<?php
+
+use App\Http\Controllers\Api\AiAgentController;
+use App\Http\Controllers\Api\AuthController;
+use App\Http\Controllers\Api\CityController;
+use App\Http\Controllers\Api\LegalController;
+use App\Http\Controllers\Api\StoreController;
+use App\Http\Controllers\Api\UserController;
+use App\Http\Middleware\EnsureUserIsActive;
+use App\Http\Middleware\EnsureUserIsAdmin;
+use Illuminate\Session\Middleware\StartSession;
+use Illuminate\Support\Facades\Route;
+
+/*
+|--------------------------------------------------------------------------
+| City10 API Routes
+|--------------------------------------------------------------------------
+|
+| Public endpoints (register, login, legal documents) are available to
+| guests. All remaining routes require a Sanctum personal access token.
+| Administrative resources are additionally protected by role checks.
+|
+*/
+
+// ---------------------------------------------------------------------------
+// Public endpoints
+// ---------------------------------------------------------------------------
+
+// The CAPTCHA lives in the session, so these public form endpoints need
+// session middleware (normally reserved for the "web" group) to persist
+// the challenge between the captcha and the login/register calls.
+Route::middleware(StartSession::class)->group(function (): void {
+    Route::get('/auth/captcha', [AuthController::class, 'captcha']);
+    Route::post('/auth/register', [AuthController::class, 'register'])->middleware('throttle:10,1');
+    Route::post('/auth/login', [AuthController::class, 'login'])->middleware('throttle:10,1');
+});
+
+Route::get('/legal/documents', [LegalController::class, 'index']);
+
+// ---------------------------------------------------------------------------
+// Authenticated endpoints
+// ---------------------------------------------------------------------------
+
+Route::middleware(['auth:sanctum', EnsureUserIsActive::class])->group(function (): void {
+    Route::get('/auth/me', [AuthController::class, 'me']);
+    Route::post('/auth/logout', [AuthController::class, 'logout']);
+
+    // Legal consent (accessible before terms are accepted, by design).
+    Route::get('/legal/status', [LegalController::class, 'status']);
+    Route::post('/legal/accept', [LegalController::class, 'accept']);
+    Route::get('/legal/history', [LegalController::class, 'history']);
+
+    // World snapshot for the 3D renderer.
+    Route::get('/city/world', [CityController::class, 'world']);
+
+    // Stores: users manage their own, admins manage all.
+    Route::apiResource('stores', StoreController::class);
+    Route::get('/stores-world/seed', [StoreController::class, 'world']);
+
+    // Profile.
+    Route::patch('/auth/profile', [AuthController::class, 'updateProfile']);
+});
+
+// ---------------------------------------------------------------------------
+// Admin-only endpoints
+// ---------------------------------------------------------------------------
+
+Route::middleware(['auth:sanctum', EnsureUserIsActive::class, EnsureUserIsAdmin::class])
+    ->prefix('admin')
+    ->group(function (): void {
+        Route::apiResource('users', UserController::class);
+        Route::delete('users/{user}/deactivate', [UserController::class, 'destroy']);
+        Route::apiResource('agents', AiAgentController::class)->except(['show']);
+        Route::get('/agents-meta/models', [AiAgentController::class, 'models']);
+        Route::get('/agents-world/seed', [AiAgentController::class, 'world']);
+    });