feat: harden admin auth and ticket workflows

- add rotating admin refresh tokens and password gates\n- expand ticket galleries, exports, and client resources\n- improve IP allocation auditing and dashboard data\n- enforce encrypted client access tokens on public routes

app/Http/Controllers/Api/Admin/Setting/SettingController.php

@@ -15,12 +15,36 @@ use App\Support\Turnstile;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\Mail;
 use Illuminate\Support\Facades\Storage;
 use Illuminate\Support\Facades\Validator;
 
 class SettingController extends Controller
 {
+    public function verifyPassword(Request $request): JsonResponse
+    {
+        $data = $request->validate([
+            'password' => ['required', 'string'],
+        ], [
+            'password.required' => 'Vui lòng nhập mật khẩu hiện tại.',
+        ]);
+
+        $user = $request->user('admin');
+
+        if (!$user || !Hash::check($data['password'], $user->password)) {
+            return response()->json([
+                'error' => true,
+                'message' => 'Mật khẩu hiện tại không chính xác.',
+            ], 422);
+        }
+
+        return response()->json([
+            'error' => false,
+            'message' => 'Xác thực thành công.',
+        ]);
+    }
+
     /**
      * GET /administrator/settings
      * Returns all setting keys: setting, smtp.