Initial commit — Grow baby tracker

Next.js 16 App Router, Prisma + PostgreSQL, NextAuth v5 JWT.

Features: dashboard quick-log, timeline, growth charts (WHO percentiles),
stats, journal/notes, doctor notes, milestones, vaccinations, settings,
superadmin panel. Mobile-first with sidebar nav + bottom nav + quick-add FAB.
Dark mode, PWA push notifications, multi-family invite system.

Docker: multi-stage Dockerfile + docker-compose with postgres service.

src/app/api/milestones/route.ts

@@ -0,0 +1,49 @@
+import { NextResponse } from "next/server";
+import { auth } from "@/lib/auth";
+import { prisma } from "@/lib/prisma";
+
+export async function GET(req: Request) {
+  const session = await auth();
+  if (!session?.user?.id) return NextResponse.json({ error: "Non autorisé" }, { status: 401 });
+
+  const { searchParams } = new URL(req.url);
+  const babyId = searchParams.get("babyId");
+
+  if (!babyId) return NextResponse.json({ error: "babyId requis" }, { status: 400 });
+
+  const milestones = await prisma.milestone.findMany({
+    where: { babyId },
+    orderBy: { date: "desc" },
+  });
+
+  return NextResponse.json(milestones);
+}
+
+export async function POST(req: Request) {
+  const session = await auth();
+  if (!session?.user?.id) return NextResponse.json({ error: "Non autorisé" }, { status: 401 });
+
+  const role = (session.user as { role?: string }).role;
+  if (role === "READONLY") {
+    return NextResponse.json({ error: "Accès en lecture seule" }, { status: 403 });
+  }
+
+  const body = await req.json();
+  const { babyId, title, date, notes, icon } = body;
+
+  if (!babyId || !title || !date) {
+    return NextResponse.json({ error: "Champs requis manquants" }, { status: 400 });
+  }
+
+  const milestone = await prisma.milestone.create({
+    data: {
+      babyId,
+      title,
+      date: new Date(date),
+      notes: notes ?? null,
+      icon: icon ?? null,
+    },
+  });
+
+  return NextResponse.json(milestone, { status: 201 });
+}