Add security middleware, audit log, alerts, PayPal, cron, radio + apps

Security (launch blockers):
- src/middleware.ts (edge): forwards x-pathname + real client IP.
- access-guard.ts (Node, from root layout): routes non-staff to /maintenance
  when maintenance mode is on, banned users to /banned. New /banned + /maintenance
  pages (the consumers the admin toggle was missing). Admin layout enforces
  force_staff_2fa before /admin.
- staff-activity.ts audit log wired into ban/lift/give-currency/set-rank actions.

Infra (parallel agents): alert service (alert_logs + Discord embed + email),
PayPal top-up (create/capture API routes + /shop/topup), cron worker
(scripts/jobs-worker.ts via croner: emulator-ping->alert, maintenance-check,
bans-cleanup), social connections page, admin radio settings/banners/ranks.
Public radio subsystem: /radio (+schedule, shouts+post, contests, giveaways,
apply, leaderboard) and /apply/staff + /apply/team submission forms. Radio nav
link added. .env.example documents the new optional vars.

(radio song-requests dropped: its table is a stub in AtomCMS — columns added by
un-modeled alter-migrations.)

Verified: tsc exit 0, vitest 48/48, next build exit 0 (82 page routes).

src/actions/radio-apply.ts

@@ -0,0 +1,65 @@
+"use server";
+
+import { revalidatePath } from "next/cache";
+import { auth } from "@/lib/auth";
+import { prisma } from "@/lib/prisma";
+
+// Column bounds from prisma/schema.prisma (radio_applications):
+//   real_name VARCHAR(255); the rest are TEXT. age is an INT.
+const NAME_MAX = 255;
+const TEXT_MAX = 5000;
+const STYLE_MAX = 5000;
+
+function str(form: FormData, key: string, max: number): string {
+  return String(form.get(key) ?? "").trim().slice(0, max);
+}
+
+/**
+ * Submit a radio DJ application.
+ *
+ * The applicant (userId) is ALWAYS re-read from the session via auth() and is
+ * never taken from the submitted FormData, so a crafted form cannot file an
+ * application on behalf of another account. radio_applications.user_id is an
+ * UnsignedBigInt, hence the BigInt() coercion.
+ */
+export async function applyDj(formData: FormData): Promise<void> {
+  const session = await auth();
+  const userId = Number(session?.user?.id);
+  if (!Number.isInteger(userId) || userId <= 0) return;
+
+  const realName = str(formData, "realName", NAME_MAX);
+  const availability = str(formData, "availability", TEXT_MAX);
+  const motivation = str(formData, "motivation", TEXT_MAX);
+  const experience = str(formData, "experience", TEXT_MAX);
+  const musicStyle = str(formData, "musicStyle", STYLE_MAX);
+
+  const ageRaw = Number(formData.get("age"));
+  const age = Number.isInteger(ageRaw) ? ageRaw : 0;
+
+  // Required fields per the schema (NOT NULL): real_name, age, availability,
+  // motivation. experience + music_style are nullable.
+  if (!realName || !availability || !motivation || age <= 0) return;
+
+  const now = new Date();
+  try {
+    await prisma.radioApplications.create({
+      data: {
+        userId: BigInt(userId),
+        realName,
+        age,
+        availability,
+        motivation,
+        experience: experience || null,
+        musicStyle: musicStyle || null,
+        status: "pending",
+        createdAt: now,
+        updatedAt: now,
+      },
+    });
+  } catch {
+    // DB unavailable or duplicate — fail soft; nothing to persist.
+    return;
+  }
+
+  revalidatePath("/radio/apply");
+}