Add register + logout auth flows, and batch-5 resources

Auth (hand-built, uses the auth core):
- /register + register() action: validates, hashes with argon2id (hashPassword),
  creates an emulator-compatible users row (accountCreated/ipRegister/ipCurrent/
  look), redirect kept outside try so NEXT_REDIRECT propagates. Login/register
  cross-links; header shows Register (logged-out) and a Logout (signOut) button.

Batch 5 (parallel agents): /admin/rooms (+[id]) search+detail, /admin/vouchers
(CRUD), /admin/subscriptions (read), /admin/calendar (campaigns+rewards read),
/marketplace (public). Header + admin nav extended.

Verified: tsc exit 0, vitest 48/48, next build exit 0 (52 page routes).

src/actions/admin-vouchers.ts

@@ -0,0 +1,66 @@
+"use server";
+
+import { revalidatePath } from "next/cache";
+import { requireStaff } from "@/lib/admin/guard";
+import { prisma } from "@/lib/prisma";
+
+export async function createVoucher(formData: FormData): Promise<void> {
+  await requireStaff();
+
+  const code = String(formData.get("code") ?? "").trim().slice(0, 255);
+  const amount = Number(formData.get("amount"));
+  const maxUsesRaw = Number(formData.get("maxUses"));
+  const maxUses = Number.isFinite(maxUsesRaw) && maxUsesRaw > 0 ? Math.floor(maxUsesRaw) : 1;
+
+  if (!code || !(amount > 0)) return;
+
+  const expiresRaw = String(formData.get("expiresAt") ?? "").trim();
+  let expiresAt: Date | null = null;
+  if (expiresRaw) {
+    const parsed = new Date(expiresRaw);
+    if (!Number.isNaN(parsed.getTime())) expiresAt = parsed;
+  }
+
+  const now = new Date();
+
+  try {
+    await prisma.websiteShopVouchers.create({
+      data: {
+        code,
+        amount: Math.floor(amount),
+        maxUses,
+        useCount: 0,
+        expiresAt,
+        createdAt: now,
+        updatedAt: now,
+      },
+    });
+  } catch {
+    // Unique constraint on `code` (or DB unavailable) — swallow and re-render.
+    return;
+  }
+
+  revalidatePath("/admin/vouchers");
+}
+
+export async function deleteVoucher(formData: FormData): Promise<void> {
+  await requireStaff();
+
+  const raw = String(formData.get("id") ?? "").trim();
+  if (!raw) return;
+
+  let id: bigint;
+  try {
+    id = BigInt(raw);
+  } catch {
+    return;
+  }
+
+  try {
+    await prisma.websiteShopVouchers.delete({ where: { id } });
+  } catch {
+    return;
+  }
+
+  revalidatePath("/admin/vouchers");
+}