Fill the remaining gaps: badge upload, radio tools, VPN, writeable boxes

Built the admin tools previously listed as missing:
- Badge upload (/admin/badges): uploads a <code>.gif into the emulator's
  badge dir via BADGE_UPLOAD_DIR (node:fs); validated code/type/size,
  logged. Made configurable rather than skipped.
- Radio tools: /admin/radio/api-keys (CRUD, server-generated keys),
  /admin/radio/autodj (Auto-DJ playlist CRUD), /admin/radio/embed (embed
  snippet generator), /admin/radio/points (points settings),
  /admin/radio/monitoring (live stream/now-playing/listeners status).
  radio_api_keys + radio_auto_dj_playlist already had real columns.
- /admin/vpn: VPN/proxy detection config (block toggle + provider + key),
  complementing /admin/ip's raw blacklist.
- Writeable boxes: new website_writeable_boxes table (model + migration
  0006) + /admin/writeable-boxes CRUD; active boxes render on the public
  home page. env: BADGE_UPLOAD_DIR.

Verified live (prod, amx_test): all 8 pages render with real data; a test
writeable box appeared on the public home and was reverted. tsc 0,
vitest 49/49, next build 0 (7 new admin routes).

src/actions/admin-writeable-boxes.ts

@@ -0,0 +1,155 @@
+"use server";
+
+import { revalidatePath } from "next/cache";
+import { requireStaff } from "@/lib/admin/guard";
+import { prisma } from "@/lib/prisma";
+import { logStaffActivity } from "@/lib/services/staff-activity";
+
+// Writeable boxes (website_writeable_boxes). CMS-owned table backing the
+// content panels rendered on the public home page. Active boxes (is_active)
+// are the ones shown publicly, ordered by `position`.
+
+/** Parse a non-negative Int form value, falling back to 0. */
+function reqInt(formData: FormData, key: string): number {
+  const raw = String(formData.get(key) ?? "").trim();
+  if (raw === "") return 0;
+  const n = Number(raw);
+  if (!Number.isFinite(n) || n < 0) return 0;
+  return Math.floor(n);
+}
+
+/** Parse the BigInt `id` form value, returning null when blank/invalid. */
+function parseId(formData: FormData): bigint | null {
+  const raw = String(formData.get("id") ?? "").trim();
+  if (!raw) return null;
+  try {
+    return BigInt(raw);
+  } catch {
+    return null;
+  }
+}
+
+function revalidate(): void {
+  revalidatePath("/admin/writeable-boxes");
+  // Active boxes render on the public home page (root layout).
+  revalidatePath("/", "layout");
+}
+
+export async function createBox(formData: FormData): Promise<void> {
+  const staff = await requireStaff();
+
+  const title = String(formData.get("title") ?? "").trim().slice(0, 255);
+  if (!title) return;
+
+  const now = new Date();
+  try {
+    const created = await prisma.websiteWriteableBoxes.create({
+      data: {
+        title,
+        icon: (String(formData.get("icon") ?? "").trim().slice(0, 255)) || null,
+        content: String(formData.get("content") ?? ""),
+        position: reqInt(formData, "position"),
+        isActive: String(formData.get("isActive") ?? "") === "1",
+        createdAt: now,
+        updatedAt: now,
+      },
+    });
+    await logStaffActivity({
+      staffId: staff.id,
+      action: "writeable_box_create",
+      description: `Created writeable box "${title}" (#${created.id})`,
+      targetType: "writeable_box",
+      targetId: Number(created.id),
+    });
+  } catch {
+    // DB unavailable — swallow and re-render.
+    return;
+  }
+
+  revalidate();
+}
+
+export async function updateBox(formData: FormData): Promise<void> {
+  const staff = await requireStaff();
+
+  const id = parseId(formData);
+  if (id == null) return;
+
+  const title = String(formData.get("title") ?? "").trim().slice(0, 255);
+  if (!title) return;
+
+  try {
+    await prisma.websiteWriteableBoxes.update({
+      where: { id },
+      data: {
+        title,
+        icon: (String(formData.get("icon") ?? "").trim().slice(0, 255)) || null,
+        content: String(formData.get("content") ?? ""),
+        position: reqInt(formData, "position"),
+        isActive: String(formData.get("isActive") ?? "") === "1",
+        updatedAt: new Date(),
+      },
+    });
+    await logStaffActivity({
+      staffId: staff.id,
+      action: "writeable_box_update",
+      description: `Updated writeable box #${id} ("${title}")`,
+      targetType: "writeable_box",
+      targetId: Number(id),
+    });
+  } catch {
+    return;
+  }
+
+  revalidate();
+}
+
+export async function deleteBox(formData: FormData): Promise<void> {
+  const staff = await requireStaff();
+
+  const id = parseId(formData);
+  if (id == null) return;
+
+  try {
+    await prisma.websiteWriteableBoxes.delete({ where: { id } });
+    await logStaffActivity({
+      staffId: staff.id,
+      action: "writeable_box_delete",
+      description: `Deleted writeable box #${id}`,
+      targetType: "writeable_box",
+      targetId: Number(id),
+    });
+  } catch {
+    return;
+  }
+
+  revalidate();
+}
+
+export async function toggleBox(formData: FormData): Promise<void> {
+  const staff = await requireStaff();
+
+  const id = parseId(formData);
+  if (id == null) return;
+
+  // `next` carries the desired state ("1" to activate, anything else to hide).
+  const next = String(formData.get("next") ?? "") === "1";
+
+  try {
+    await prisma.websiteWriteableBoxes.update({
+      where: { id },
+      data: { isActive: next, updatedAt: new Date() },
+    });
+    await logStaffActivity({
+      staffId: staff.id,
+      action: "writeable_box_toggle",
+      description: `${next ? "Activated" : "Hid"} writeable box #${id}`,
+      targetType: "writeable_box",
+      targetId: Number(id),
+    });
+  } catch {
+    return;
+  }
+
+  revalidate();
+}