feat: harden bootstrap and add tests

src/app/api/admin/menu/route.ts

@@ -2,6 +2,8 @@ import { NextRequest, NextResponse } from 'next/server';
 import { requireRole } from '@/lib/auth';
 import { db } from '@/lib/db';
 
+export const dynamic = 'force-dynamic'; // Prevents static generation
+
 // GET /api/admin/menu — returns ALL menu items (including inactive)
 export async function GET() {
   try {

src/app/api/admin/reviews/route.ts

@@ -2,6 +2,8 @@ import { NextRequest, NextResponse } from 'next/server';
 import { requireRole } from '@/lib/auth';
 import { db } from '@/lib/db';
 
+export const dynamic = 'force-dynamic'; // Prevents static generation
+
 export async function GET() {
   try {
     await requireRole('admin');

src/app/api/bootstrap-user/route.ts

@@ -1,11 +1,18 @@
-import { NextRequest, NextResponse } from 'next/server';
+import { NextResponse } from 'next/server';
 import { createUser } from '@/lib/auth';
 
 export async function POST() {
   try {
-    const user = await createUser('mmendoza', 'W3canbeheroes*-*', 'admin');
+    const username = process.env.BOOTSTRAP_ADMIN_USERNAME || 'mmendoza';
+    const password = process.env.BOOTSTRAP_ADMIN_PASSWORD;
+
+    if (!password) {
+      return NextResponse.json({ error: 'Bootstrap password is not configured' }, { status: 500 });
+    }
+
+    const user = await createUser(username, password, 'admin');
     return NextResponse.json({ ok: true, user: { id: user.id, username: user.username, role: user.role } });
   } catch (err: any) {
-    return NextResponse.json({ error: err.message || 'Failed to create user' }, { status: 500 });
+    return NextResponse.json({ error: err?.message || 'Failed to create bootstrap user' }, { status: 500 });
   }
 }

src/app/api/health/route.ts

@@ -0,0 +1,19 @@
+import { NextResponse } from 'next/server';
+
+export const dynamic = 'force-dynamic';
+
+export async function GET() {
+  return NextResponse.json(
+    {
+      ok: true,
+      status: 'healthy',
+      timestamp: new Date().toISOString(),
+    },
+    {
+      status: 200,
+      headers: {
+        'cache-control': 'no-store, max-age=0',
+      },
+    }
+  );
+}

src/app/api/social_events/public/route.ts

@@ -1,6 +1,8 @@
 import { db } from '@/lib/db';
 import { NextResponse } from 'next/server';
 
+export const dynamic = 'force-dynamic'; // Prevents static generation
+
 export async function GET() {
   try {
     const { rows } = await db.query(`

src/app/api/user/portal/route.ts

@@ -2,6 +2,8 @@ import { NextResponse } from 'next/server';
 import { requireRole } from '@/lib/auth';
 import { db } from '@/lib/db';
 
+export const dynamic = 'force-dynamic'; // Prevents static generation
+
 export async function GET() {
   try {
     const session = await requireRole('user');