Fill the remaining gaps: badge upload, radio tools, VPN, writeable boxes

Built the admin tools previously listed as missing:
- Badge upload (/admin/badges): uploads a <code>.gif into the emulator's
  badge dir via BADGE_UPLOAD_DIR (node:fs); validated code/type/size,
  logged. Made configurable rather than skipped.
- Radio tools: /admin/radio/api-keys (CRUD, server-generated keys),
  /admin/radio/autodj (Auto-DJ playlist CRUD), /admin/radio/embed (embed
  snippet generator), /admin/radio/points (points settings),
  /admin/radio/monitoring (live stream/now-playing/listeners status).
  radio_api_keys + radio_auto_dj_playlist already had real columns.
- /admin/vpn: VPN/proxy detection config (block toggle + provider + key),
  complementing /admin/ip's raw blacklist.
- Writeable boxes: new website_writeable_boxes table (model + migration
  0006) + /admin/writeable-boxes CRUD; active boxes render on the public
  home page. env: BADGE_UPLOAD_DIR.

Verified live (prod, amx_test): all 8 pages render with real data; a test
writeable box appeared on the public home and was reverted. tsc 0,
vitest 49/49, next build 0 (7 new admin routes).

src/actions/admin-vpn.ts

@@ -0,0 +1,69 @@
+"use server";
+
+import { revalidatePath } from "next/cache";
+import { redirect } from "next/navigation";
+import { requireStaff } from "@/lib/admin/guard";
+import { prisma } from "@/lib/prisma";
+import { siteSettings } from "@/lib/services/site-settings";
+import { logStaffActivity } from "@/lib/services/staff-activity";
+
+// VPN / proxy detection config. Stored as website_settings key/value rows
+// (CMS-owned, BigInt id). Booleans use the strings "0" / "1", faithful to
+// AtomCMS's setting() convention. This is registration-time protection only;
+// the raw IP allow/deny list lives under /admin/ip (website_ip_*).
+
+const ALLOWED_PROVIDERS = new Set(["none", "proxycheck", "ipqualityscore"]);
+
+/** Upsert one website_settings key with a stable housekeeping comment. */
+async function writeSetting(key: string, value: string, comment: string): Promise<void> {
+  await prisma.websiteSetting.upsert({
+    where: { key },
+    update: { value },
+    create: { key, value, comment },
+  });
+}
+
+export async function saveVpn(formData: FormData): Promise<void> {
+  const staff = await requireStaff();
+
+  // Toggle: an unchecked checkbox submits nothing, so absence === disabled.
+  const enabled = String(formData.get("vpn_block_enabled") ?? "").trim() !== "";
+
+  const providerRaw = String(formData.get("vpn_provider") ?? "").trim().toLowerCase();
+  const provider = ALLOWED_PROVIDERS.has(providerRaw) ? providerRaw : "none";
+
+  const apiKey = String(formData.get("vpn_api_key") ?? "").trim().slice(0, 255);
+  const blockMessage = String(formData.get("vpn_block_message") ?? "").trim().slice(0, 255);
+
+  try {
+    await writeSetting(
+      "vpn_block_enabled",
+      enabled ? "1" : "0",
+      "Block registrations from detected VPN/proxy IPs (0=no, 1=yes)",
+    );
+    await writeSetting(
+      "vpn_provider",
+      provider,
+      "VPN/proxy detection provider (none/proxycheck/ipqualityscore)",
+    );
+    await writeSetting("vpn_api_key", apiKey, "API key for the VPN/proxy detection provider");
+    await writeSetting(
+      "vpn_block_message",
+      blockMessage,
+      "Message shown to users blocked for using a VPN/proxy",
+    );
+
+    siteSettings.reload();
+    await logStaffActivity({
+      staffId: staff.id,
+      action: "vpn_update",
+      description: `Updated VPN/proxy detection (block=${enabled ? "on" : "off"}, provider=${provider})`,
+    });
+    revalidatePath("/admin/vpn");
+  } catch {
+    // DB unavailable — fail soft so the action does not throw; the page
+    // re-renders the current (stored) state.
+  }
+
+  redirect("/admin/vpn?saved=1");
+}