feat: middleware protection routes + restriction admin /parametres

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/middleware.ts

@@ -0,0 +1,27 @@
+import { withAuth } from 'next-auth/middleware'
+import { NextResponse } from 'next/server'
+
+export default withAuth(
+  function middleware(req) {
+    const { token } = req.nextauth
+    const { pathname } = req.nextUrl
+
+    // Seuls les admins accèdent à /parametres
+    if (pathname.startsWith('/parametres') && token?.role !== 'admin') {
+      return NextResponse.redirect(new URL('/', req.url))
+    }
+
+    return NextResponse.next()
+  },
+  {
+    callbacks: {
+      authorized: ({ token }) => !!token,
+    },
+  }
+)
+
+export const config = {
+  matcher: [
+    '/((?!login|api/auth|_next/static|_next/image|favicon\\.ico).*)',
+  ],
+}