feat: Introduce guest access for video viewing, implement user notification settings via email and Telegram, and add rate limiting infrastructure.

app/api/projects/[projectId]/videos/[videoId]/route.ts

@@ -54,7 +54,10 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
             return NextResponse.json({ error: 'Access denied' }, { status: 403 });
         }
 
-        return NextResponse.json(video);
+        return NextResponse.json({
+            ...video,
+            isAuthenticated: !!session?.user?.id,
+        });
     } catch (error) {
         console.error('Error fetching video:', error);
         return NextResponse.json(

app/api/projects/[projectId]/videos/route.ts

@@ -4,6 +4,7 @@ import { auth } from '@/lib/auth';
 import { ProjectMemberRole } from '@prisma/client';
 import { validateUrl, validateOptionalUrl } from '@/lib/validation';
 import { rateLimit } from '@/lib/rate-limit';
+import { notifyProjectOwner } from '@/lib/notifications';
 
 type RouteParams = { params: Promise<{ projectId: string }> };
 
@@ -141,6 +142,18 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
             },
         });
 
+        // Notify project owner (fire-and-forget, skip if they added it themselves)
+        if (project.ownerId !== session.user.id) {
+            const baseUrl = process.env.NEXTAUTH_URL || '';
+            notifyProjectOwner(project.ownerId, {
+                type: 'new_video',
+                projectName: project.name,
+                videoTitle: title.trim(),
+                addedBy: session.user.name || 'A team member',
+                url: `${baseUrl}/watch/${video.id}`,
+            }).catch((err) => console.error('Notification failed:', err));
+        }
+
         return NextResponse.json(video, { status: 201 });
     } catch (error) {
         console.error('Error creating video:', error);