Add security middleware, audit log, alerts, PayPal, cron, radio + apps

Security (launch blockers):
- src/middleware.ts (edge): forwards x-pathname + real client IP.
- access-guard.ts (Node, from root layout): routes non-staff to /maintenance
  when maintenance mode is on, banned users to /banned. New /banned + /maintenance
  pages (the consumers the admin toggle was missing). Admin layout enforces
  force_staff_2fa before /admin.
- staff-activity.ts audit log wired into ban/lift/give-currency/set-rank actions.

Infra (parallel agents): alert service (alert_logs + Discord embed + email),
PayPal top-up (create/capture API routes + /shop/topup), cron worker
(scripts/jobs-worker.ts via croner: emulator-ping->alert, maintenance-check,
bans-cleanup), social connections page, admin radio settings/banners/ranks.
Public radio subsystem: /radio (+schedule, shouts+post, contests, giveaways,
apply, leaderboard) and /apply/staff + /apply/team submission forms. Radio nav
link added. .env.example documents the new optional vars.

(radio song-requests dropped: its table is a stub in AtomCMS — columns added by
un-modeled alter-migrations.)

Verified: tsc exit 0, vitest 48/48, next build exit 0 (82 page routes).

src/actions/radio-shouts.ts

@@ -0,0 +1,44 @@
+"use server";
+
+import { revalidatePath } from "next/cache";
+import { auth } from "@/lib/auth";
+import { prisma } from "@/lib/prisma";
+
+// radio_shouts.message is TEXT, but cap the write to keep shouts tweet-sized.
+const MESSAGE_MAX = 255;
+
+/**
+ * Post a radio shout.
+ *
+ * The AUTHOR (userId) is re-read from the session via auth() and is never
+ * trusted from the submitted FormData, so a crafted form cannot impersonate
+ * another account. radio_shouts.user_id is an UNSIGNED BIGINT, so the Int
+ * session id is widened to BigInt for the insert.
+ */
+export async function postShout(formData: FormData): Promise<void> {
+  const session = await auth();
+  const userId = Number(session?.user?.id);
+  if (!Number.isInteger(userId) || userId <= 0) return;
+
+  const message = String(formData.get("message") ?? "")
+    .trim()
+    .slice(0, MESSAGE_MAX);
+  if (!message) return;
+
+  const now = new Date();
+  try {
+    await prisma.radioShouts.create({
+      data: {
+        userId: BigInt(userId),
+        message,
+        createdAt: now,
+        updatedAt: now,
+      },
+    });
+  } catch {
+    // DB unavailable — fail soft; nothing to persist.
+    return;
+  }
+
+  revalidatePath("/radio/shouts");
+}