Add security middleware, audit log, alerts, PayPal, cron, radio + apps

Security (launch blockers):
- src/middleware.ts (edge): forwards x-pathname + real client IP.
- access-guard.ts (Node, from root layout): routes non-staff to /maintenance
  when maintenance mode is on, banned users to /banned. New /banned + /maintenance
  pages (the consumers the admin toggle was missing). Admin layout enforces
  force_staff_2fa before /admin.
- staff-activity.ts audit log wired into ban/lift/give-currency/set-rank actions.

Infra (parallel agents): alert service (alert_logs + Discord embed + email),
PayPal top-up (create/capture API routes + /shop/topup), cron worker
(scripts/jobs-worker.ts via croner: emulator-ping->alert, maintenance-check,
bans-cleanup), social connections page, admin radio settings/banners/ranks.
Public radio subsystem: /radio (+schedule, shouts+post, contests, giveaways,
apply, leaderboard) and /apply/staff + /apply/team submission forms. Radio nav
link added. .env.example documents the new optional vars.

(radio song-requests dropped: its table is a stub in AtomCMS — columns added by
un-modeled alter-migrations.)

Verified: tsc exit 0, vitest 48/48, next build exit 0 (82 page routes).

src/actions/admin-bans.ts

@@ -4,6 +4,7 @@ import { revalidatePath } from "next/cache";
 import { requireStaff } from "@/lib/admin/guard";
 import { prisma } from "@/lib/prisma";
 import { rcon } from "@/lib/services/rcon";
+import { logStaffActivity } from "@/lib/services/staff-activity";
 
 type BanType = "account" | "ip" | "machine" | "super";
 const BAN_TYPES: ReadonlySet<string> = new Set(["account", "ip", "machine", "super"]);
@@ -40,12 +41,26 @@ export async function createBan(formData: FormData): Promise<void> {
   });
 
   if (user) await rcon.disconnectUser(userId, user.username);
+  await logStaffActivity({
+    staffId: staff.id,
+    action: "user_ban",
+    description: `Banned user #${userId} (${type}, ${hours > 0 ? `${hours}h` : "permanent"}): ${reason}`,
+    targetType: "user",
+    targetId: userId,
+  });
   revalidatePath("/admin/bans");
 }
 
 export async function liftBan(formData: FormData): Promise<void> {
-  await requireStaff();
+  const staff = await requireStaff();
   const id = Number(formData.get("id"));
-  if (id > 0) await prisma.ban.delete({ where: { id } });
+  if (id > 0) {
+    await prisma.ban.delete({ where: { id } });
+    await logStaffActivity({
+      staffId: staff.id,
+      action: "ban_lift",
+      description: `Lifted ban #${id}`,
+    });
+  }
   revalidatePath("/admin/bans");
 }