Fill the remaining gaps: badge upload, radio tools, VPN, writeable boxes

Built the admin tools previously listed as missing:
- Badge upload (/admin/badges): uploads a <code>.gif into the emulator's
  badge dir via BADGE_UPLOAD_DIR (node:fs); validated code/type/size,
  logged. Made configurable rather than skipped.
- Radio tools: /admin/radio/api-keys (CRUD, server-generated keys),
  /admin/radio/autodj (Auto-DJ playlist CRUD), /admin/radio/embed (embed
  snippet generator), /admin/radio/points (points settings),
  /admin/radio/monitoring (live stream/now-playing/listeners status).
  radio_api_keys + radio_auto_dj_playlist already had real columns.
- /admin/vpn: VPN/proxy detection config (block toggle + provider + key),
  complementing /admin/ip's raw blacklist.
- Writeable boxes: new website_writeable_boxes table (model + migration
  0006) + /admin/writeable-boxes CRUD; active boxes render on the public
  home page. env: BADGE_UPLOAD_DIR.

Verified live (prod, amx_test): all 8 pages render with real data; a test
writeable box appeared on the public home and was reverted. tsc 0,
vitest 49/49, next build 0 (7 new admin routes).

prisma/migrations/0006_writeable_boxes.sql

@@ -0,0 +1,13 @@
+-- CMS-owned editable content boxes (AtomCMS WriteableBox). Rendered on the
+-- public site and managed from housekeeping. Idempotent (MariaDB).
+CREATE TABLE IF NOT EXISTS website_writeable_boxes (
+  id         BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
+  title      VARCHAR(255) NOT NULL,
+  icon       VARCHAR(255) NULL,
+  content    TEXT NOT NULL,
+  position   INT NOT NULL DEFAULT 0,
+  is_active  TINYINT(1) NOT NULL DEFAULT 1,
+  created_at TIMESTAMP NULL,
+  updated_at TIMESTAMP NULL,
+  PRIMARY KEY (id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

prisma/schema.prisma

@@ -1674,6 +1674,19 @@ model WebsiteWordfilter {
   @@map("website_wordfilter")
 }
 
+model WebsiteWriteableBoxes {
+  id        BigInt    @id @default(autoincrement()) @db.UnsignedBigInt
+  title     String    @db.VarChar(255)
+  icon      String?   @db.VarChar(255)
+  content   String    @db.Text
+  position  Int       @default(0)
+  isActive  Boolean   @default(true) @map("is_active")
+  createdAt DateTime? @map("created_at") @db.Timestamp(0)
+  updatedAt DateTime? @map("updated_at") @db.Timestamp(0)
+
+  @@map("website_writeable_boxes")
+}
+
 model WebsiteBetaCodes {
   id        BigInt   @id @default(autoincrement()) @db.UnsignedBigInt
   code      String   @unique @db.VarChar(255)