feat: return JSON analytics and restrict to admin user

Co-authored-by: aider (deepseek/deepseek-chat) <aider@aider.chat>

Author: umaarov

app/Http/Controllers/ReferralAnalyticsController.php

@@ -3,18 +3,29 @@
 namespace App\Http\Controllers;
 
 use App\Models\ReferralClick;
+use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
-use Illuminate\View\View;
 
 class ReferralAnalyticsController extends Controller
 {
-    public function index(): View
+    public function index(): JsonResponse
     {
+        // Ensure user is authenticated
+        if (!auth()->check()) {
+            return response()->json(['error' => 'Unauthenticated.'], 401);
+        }
+
+        // Ensure user is the admin
+        $adminUserId = (int) env('ADMIN_USER_ID', 0);
+        if (auth()->id() !== $adminUserId) {
+            return response()->json(['error' => 'Forbidden.'], 403);
+        }
+
         $clicks = ReferralClick::selectRaw('referrer, COUNT(*) as total')
             ->groupBy('referrer')
             ->orderByDesc('total')
             ->get();
 
-        return view('referral.analytics', compact('clicks'));
+        return response()->json($clicks);
     }
 }