feat(orders): idempotency guard, order numbers, button lock, success page, my-orders, admin polling

shop/app/api/admin/recent-orders/route.ts

@@ -0,0 +1,30 @@
+import { createClient } from '@/lib/supabase/server'
+import { NextResponse } from 'next/server'
+
+/**
+ * GET /api/admin/recent-orders
+ * Gibt die letzten 10 Bestellungen zurück.
+ * Wird vom Admin-Dashboard alle 30 Sekunden gepollt.
+ * Zugriff nur für authentifizierte User (Supabase Session).
+ */
+export async function GET() {
+  const supabase = await createClient()
+
+  // Session prüfen
+  const { data: { user }, error: authError } = await supabase.auth.getUser()
+  if (authError || !user) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  }
+
+  const { data: orders, error } = await supabase
+    .from('orders')
+    .select('id, order_number, created_at, total_price, status, customer_data')
+    .order('created_at', { ascending: false })
+    .limit(10)
+
+  if (error) {
+    return NextResponse.json({ error: error.message }, { status: 500 })
+  }
+
+  return NextResponse.json({ orders })
+}