Fill the remaining gaps: badge upload, radio tools, VPN, writeable boxes

Built the admin tools previously listed as missing:
- Badge upload (/admin/badges): uploads a <code>.gif into the emulator's
  badge dir via BADGE_UPLOAD_DIR (node:fs); validated code/type/size,
  logged. Made configurable rather than skipped.
- Radio tools: /admin/radio/api-keys (CRUD, server-generated keys),
  /admin/radio/autodj (Auto-DJ playlist CRUD), /admin/radio/embed (embed
  snippet generator), /admin/radio/points (points settings),
  /admin/radio/monitoring (live stream/now-playing/listeners status).
  radio_api_keys + radio_auto_dj_playlist already had real columns.
- /admin/vpn: VPN/proxy detection config (block toggle + provider + key),
  complementing /admin/ip's raw blacklist.
- Writeable boxes: new website_writeable_boxes table (model + migration
  0006) + /admin/writeable-boxes CRUD; active boxes render on the public
  home page. env: BADGE_UPLOAD_DIR.

Verified live (prod, amx_test): all 8 pages render with real data; a test
writeable box appeared on the public home and was reverted. tsc 0,
vitest 49/49, next build 0 (7 new admin routes).

src/actions/admin-radio-api-keys.ts

@@ -0,0 +1,130 @@
+"use server";
+
+import { randomBytes } from "node:crypto";
+import { revalidatePath } from "next/cache";
+import { redirect } from "next/navigation";
+import { requireStaff } from "@/lib/admin/guard";
+import { prisma } from "@/lib/prisma";
+import { logStaffActivity } from "@/lib/services/staff-activity";
+
+// Radio API keys (radio_api_keys). External integrations (AzureCast bridges,
+// widgets, bots) authenticate with a server-generated key. The key itself is
+// minted here with crypto.randomBytes — never accepted from the form — and the
+// `permissions` JSON column is intentionally left untouched by this CMS slice.
+
+function str(raw: FormDataEntryValue | null): string {
+  return typeof raw === "string" ? raw : "";
+}
+
+/** Parse a BigInt id from a form value, or null when blank/invalid. */
+function parseId(raw: FormDataEntryValue | null): bigint | null {
+  const s = str(raw).trim();
+  if (!s) return null;
+  try {
+    return BigInt(s);
+  } catch {
+    return null;
+  }
+}
+
+/** Clamp a form value to a non-negative integer (defaulting to `fallback`). */
+function intOr(raw: FormDataEntryValue | null, fallback: number): number {
+  const n = Number(str(raw).trim());
+  if (!Number.isFinite(n) || n < 0) return fallback;
+  return Math.floor(n);
+}
+
+export async function createApiKey(formData: FormData): Promise<void> {
+  const staff = await requireStaff();
+
+  const name = str(formData.get("name")).trim().slice(0, 255);
+  if (!name) return;
+
+  const rateLimit = intOr(formData.get("rateLimit"), 300);
+  const allowedIps = str(formData.get("allowedIps")).trim().slice(0, 255) || null;
+
+  // Server-side key generation — 24 random bytes → 48 hex chars (fits VarChar(64)).
+  const key = randomBytes(24).toString("hex");
+
+  const now = new Date();
+  try {
+    const created = await prisma.radioApiKeys.create({
+      data: {
+        name,
+        key,
+        allowedIps,
+        rateLimit,
+        isActive: true,
+        createdAt: now,
+        updatedAt: now,
+      },
+    });
+    await logStaffActivity({
+      staffId: staff.id,
+      action: "radio_api_key_create",
+      description: `Created radio API key "${name}" (#${created.id}, rate limit ${rateLimit})`,
+      targetType: "radio_api_key",
+      targetId: Number(created.id),
+    });
+  } catch {
+    // Unique-key collision (astronomically unlikely) or DB down — fail soft.
+    return;
+  }
+
+  revalidatePath("/admin/radio/api-keys");
+  redirect("/admin/radio/api-keys?created=1");
+}
+
+export async function toggleApiKey(formData: FormData): Promise<void> {
+  const staff = await requireStaff();
+
+  const id = parseId(formData.get("id"));
+  if (id == null) return;
+
+  try {
+    const existing = await prisma.radioApiKeys.findUnique({
+      where: { id },
+      select: { name: true, isActive: true },
+    });
+    if (!existing) return;
+
+    const next = !existing.isActive;
+    await prisma.radioApiKeys.update({
+      where: { id },
+      data: { isActive: next, updatedAt: new Date() },
+    });
+    await logStaffActivity({
+      staffId: staff.id,
+      action: "radio_api_key_toggle",
+      description: `${next ? "Activated" : "Deactivated"} radio API key "${existing.name}" (#${id})`,
+      targetType: "radio_api_key",
+      targetId: Number(id),
+    });
+  } catch {
+    return;
+  }
+
+  revalidatePath("/admin/radio/api-keys");
+}
+
+export async function deleteApiKey(formData: FormData): Promise<void> {
+  const staff = await requireStaff();
+
+  const id = parseId(formData.get("id"));
+  if (id == null) return;
+
+  try {
+    await prisma.radioApiKeys.delete({ where: { id } });
+    await logStaffActivity({
+      staffId: staff.id,
+      action: "radio_api_key_delete",
+      description: `Deleted radio API key #${id}`,
+      targetType: "radio_api_key",
+      targetId: Number(id),
+    });
+  } catch {
+    return;
+  }
+
+  revalidatePath("/admin/radio/api-keys");
+}