Add security middleware, audit log, alerts, PayPal, cron, radio + apps

Security (launch blockers):
- src/middleware.ts (edge): forwards x-pathname + real client IP.
- access-guard.ts (Node, from root layout): routes non-staff to /maintenance
  when maintenance mode is on, banned users to /banned. New /banned + /maintenance
  pages (the consumers the admin toggle was missing). Admin layout enforces
  force_staff_2fa before /admin.
- staff-activity.ts audit log wired into ban/lift/give-currency/set-rank actions.

Infra (parallel agents): alert service (alert_logs + Discord embed + email),
PayPal top-up (create/capture API routes + /shop/topup), cron worker
(scripts/jobs-worker.ts via croner: emulator-ping->alert, maintenance-check,
bans-cleanup), social connections page, admin radio settings/banners/ranks.
Public radio subsystem: /radio (+schedule, shouts+post, contests, giveaways,
apply, leaderboard) and /apply/staff + /apply/team submission forms. Radio nav
link added. .env.example documents the new optional vars.

(radio song-requests dropped: its table is a stub in AtomCMS — columns added by
un-modeled alter-migrations.)

Verified: tsc exit 0, vitest 48/48, next build exit 0 (82 page routes).

src/app/admin/radio/ranks/page.tsx

@@ -0,0 +1,176 @@
+import Link from 'next/link';
+import {
+  createRadioRank,
+  deleteRadioRank,
+  updateRadioRank,
+} from '@/actions/admin-radio-extra';
+import { prisma } from '@/lib/prisma';
+
+export const dynamic = 'force-dynamic';
+
+type Rank = {
+  id: bigint;
+  name: string;
+  description: string | null;
+  badgeCode: string | null;
+  isActive: boolean;
+};
+
+export default async function AdminRadioRanksPage() {
+  let ranks: Rank[] = [];
+  let dbError = false;
+
+  try {
+    ranks = await prisma.radioRanks.findMany({
+      select: {
+        id: true,
+        name: true,
+        description: true,
+        badgeCode: true,
+        isActive: true,
+      },
+      orderBy: { id: 'asc' },
+    });
+  } catch {
+    dbError = true;
+    ranks = [];
+  }
+
+  return (
+    <main>
+      <nav className="muted" style={{ marginBottom: '0.5rem' }}>
+        <Link href="/admin/radio">Radio</Link> ·{' '}
+        <Link href="/admin/radio/settings">Settings</Link> ·{' '}
+        <Link href="/admin/radio/banners">Banners</Link> ·{' '}
+        <Link href="/admin/radio/ranks">Ranks</Link>
+      </nav>
+
+      <h1>Radio Ranks</h1>
+      <p className="muted">DJ / staff ranks assignable on radio applications.</p>
+
+      {dbError ? (
+        <div className="card" style={{ marginBottom: '1.5rem' }}>
+          <p className="muted" style={{ margin: 0 }}>
+            Could not load ranks (database unavailable).
+          </p>
+        </div>
+      ) : null}
+
+      <form action={createRadioRank} className="card" style={{ marginBottom: '1.5rem' }}>
+        <h3 style={{ marginTop: 0 }}>Add rank</h3>
+        <div className="grid cols-3">
+          <div>
+            <label htmlFor="new_name" style={{ display: 'block', fontWeight: 700 }}>
+              Name
+            </label>
+            <input id="new_name" name="name" required style={{ width: '100%' }} />
+          </div>
+          <div>
+            <label htmlFor="new_badge" style={{ display: 'block', fontWeight: 700 }}>
+              Badge code
+            </label>
+            <input id="new_badge" name="badgeCode" style={{ width: '100%' }} />
+          </div>
+          <div style={{ display: 'flex', alignItems: 'flex-end' }}>
+            <label style={{ display: 'inline-flex', gap: '0.4rem', alignItems: 'center' }}>
+              <input type="checkbox" name="isActive" value="1" defaultChecked /> Active
+            </label>
+          </div>
+          <div style={{ gridColumn: '1 / -1' }}>
+            <label htmlFor="new_desc" style={{ display: 'block', fontWeight: 700 }}>
+              Description
+            </label>
+            <input id="new_desc" name="description" style={{ width: '100%' }} />
+          </div>
+        </div>
+        <div style={{ marginTop: '0.75rem' }}>
+          <button type="submit" className="btn btn-primary">
+            Create rank
+          </button>
+        </div>
+      </form>
+
+      {ranks.length === 0 ? (
+        <p className="muted">No ranks yet.</p>
+      ) : (
+        <table>
+          <thead>
+            <tr>
+              <th>ID</th>
+              <th>Name</th>
+              <th>Badge</th>
+              <th>Description</th>
+              <th>Active</th>
+              <th />
+            </tr>
+          </thead>
+          <tbody>
+            {ranks.map((r) => (
+              <tr key={String(r.id)}>
+                <td>{String(r.id)}</td>
+                <td colSpan={5}>
+                  <form
+                    action={updateRadioRank}
+                    style={{
+                      display: 'flex',
+                      gap: '0.5rem',
+                      alignItems: 'center',
+                      flexWrap: 'wrap',
+                    }}
+                  >
+                    <input type="hidden" name="id" value={String(r.id)} />
+                    <input
+                      name="name"
+                      defaultValue={r.name}
+                      required
+                      placeholder="Name"
+                      style={{ minWidth: 140 }}
+                    />
+                    <input
+                      name="badgeCode"
+                      defaultValue={r.badgeCode ?? ''}
+                      placeholder="Badge"
+                      style={{ minWidth: 100 }}
+                    />
+                    <input
+                      name="description"
+                      defaultValue={r.description ?? ''}
+                      placeholder="Description"
+                      style={{ flex: 1, minWidth: 160 }}
+                    />
+                    <label
+                      style={{ display: 'inline-flex', gap: '0.3rem', alignItems: 'center' }}
+                    >
+                      <input
+                        type="checkbox"
+                        name="isActive"
+                        value="1"
+                        defaultChecked={r.isActive}
+                      />{' '}
+                      Active
+                    </label>
+                    <button type="submit" className="btn btn-primary">
+                      Save
+                    </button>
+                  </form>
+                </td>
+              </tr>
+            ))}
+            {ranks.map((r) => (
+              <tr key={`del_${String(r.id)}`}>
+                <td colSpan={6} style={{ borderTop: 'none', paddingTop: 0 }}>
+                  <form action={deleteRadioRank} style={{ display: 'inline' }}>
+                    <input type="hidden" name="id" value={String(r.id)} />
+                    <button type="submit" className="btn btn-danger">
+                      Delete rank #{String(r.id)}
+                    </button>
+                  </form>
+                </td>
+              </tr>
+            ))}
+          </tbody>
+        </table>
+      )}
+    </main>
+  );
+}