feat(shortener): real GeoIP analytics + redirect rate-limit/bot-filter/unique clicks

.gitignore

@@ -1,3 +1,6 @@
+# Git worktrees (repo-local, per {repo}/worktrees/{branch} convention)
+/worktrees/
+
 # Byte-compiled / optimized / DLL files
 __pycache__/
 *.py[codz]

services/flask-backend/app/__init__.py

@@ -38,6 +38,9 @@ def create_app(config_class: type | None = None) -> Quart:
 
     Returns:
         Configured Quart application instance
+
+    Raises:
+        ValueError: If production config validation fails (missing or invalid secrets)
     """
     app = Quart(__name__)
 
@@ -46,6 +49,10 @@ def create_app(config_class: type | None = None) -> Quart:
         config_class = get_config()
     app.config.from_object(config_class)
 
+    # Validate configuration (production only)
+    if hasattr(config_class, "validate"):
+        config_class.validate()
+
     # Setup logging
     _setup_logging(app)
 
@@ -73,6 +80,17 @@ def create_app(config_class: type | None = None) -> Quart:
 
     init_licensing(app)
 
+    # Initialize rate limiter
+    from .rate_limiter import init_rate_limiter
+
+    init_rate_limiter(app)
+
+    # Initialize GeoIP
+    from .geoip import init_geoip
+
+    geoip_db_path = app.config.get("GEOIP_DB_PATH")
+    init_geoip(geoip_db_path)
+
     # Apply security headers middleware
     _apply_security_headers(app)
 
@@ -250,6 +268,23 @@ def _register_blueprints(app: Quart) -> None:
 
     app.register_blueprint(tenants_bp, url_prefix="/api/v1")
 
+    # URL shortener management (Phase 3)
+    from .urls import urls_bp
+    from .collections import collections_bp
+
+    app.register_blueprint(urls_bp, url_prefix="/api/v1")
+    app.register_blueprint(collections_bp, url_prefix="/api/v1")
+
+    # Redirect endpoint (public, at root — NO auth required)
+    from .redirect import redirect_bp
+
+    app.register_blueprint(redirect_bp)
+
+    # Analytics endpoints (Phase 3 — auth required)
+    from .analytics import analytics_bp
+
+    app.register_blueprint(analytics_bp)
+
     # OAuth2 token endpoints (Phase 2)
     from .oauth import oauth_bp