Add security middleware, audit log, alerts, PayPal, cron, radio + apps

Security (launch blockers):
- src/middleware.ts (edge): forwards x-pathname + real client IP.
- access-guard.ts (Node, from root layout): routes non-staff to /maintenance
  when maintenance mode is on, banned users to /banned. New /banned + /maintenance
  pages (the consumers the admin toggle was missing). Admin layout enforces
  force_staff_2fa before /admin.
- staff-activity.ts audit log wired into ban/lift/give-currency/set-rank actions.

Infra (parallel agents): alert service (alert_logs + Discord embed + email),
PayPal top-up (create/capture API routes + /shop/topup), cron worker
(scripts/jobs-worker.ts via croner: emulator-ping->alert, maintenance-check,
bans-cleanup), social connections page, admin radio settings/banners/ranks.
Public radio subsystem: /radio (+schedule, shouts+post, contests, giveaways,
apply, leaderboard) and /apply/staff + /apply/team submission forms. Radio nav
link added. .env.example documents the new optional vars.

(radio song-requests dropped: its table is a stub in AtomCMS — columns added by
un-modeled alter-migrations.)

Verified: tsc exit 0, vitest 48/48, next build exit 0 (82 page routes).

.env.example

@@ -6,6 +6,39 @@ DATABASE_URL=mysql://user:[email protected]:3306/atomcms
 # Optional pool tuning (defaults shown)
 DATABASE_POOL_SIZE=40
 DATABASE_IDLE_TIMEOUT_MS=300000
+DATABASE_CONNECT_TIMEOUT_MS=10000
 
 # Used by SSO ticket generation ({HOTEL_NAME}-{uuid})
 HOTEL_NAME=Atom
+APP_URL=http://localhost:3000
+
+# NextAuth (>=32 chars) + Laravel APP_KEY (base64:...) for existing 2FA secrets
+AUTH_SECRET=
+APP_KEY=
+CONVERT_PASSWORDS=false
+
+# RCON link to the Arcturus emulator
+RCON_HOST=127.0.0.1
+RCON_PORT=3001
+
+# Optional OAuth (enabled when both id+secret are set)
+DISCORD_CLIENT_ID=
+DISCORD_CLIENT_SECRET=
+GOOGLE_CLIENT_ID=
+GOOGLE_CLIENT_SECRET=
+
+# Optional SMTP (password reset / alert emails)
+SMTP_HOST=
+SMTP_PORT=587
+SMTP_USER=
+SMTP_PASSWORD=
+SMTP_FROM=
+
+# Optional alerting (jobs worker / alert service)
+DISCORD_WEBHOOK_URL=
+ALERT_EMAIL=
+
+# Optional PayPal top-up (sandbox by default)
+PAYPAL_CLIENT_ID=
+PAYPAL_SECRET=
+PAYPAL_API=https://api-m.sandbox.paypal.com