Add social login (Discord/Google) + batch-6 pages

Auth: NextAuth Discord + Google providers (enabled when env id+secret set);
OAuth signIn allowed only if a hotel account matches the email; jwt binds the
session to that account (id/rank/username). Login page gets social buttons.

Batch 6 (parallel agents): /friends (messenger_friendships), /guilds/[id]/forum
(threads), /admin/navigation (navigator config), /admin/maintenance (toggle
maintenance settings), /admin/alerts (alert_logs + send hotel alert via RCON).
Header (Friends) + admin nav (Alerts/Maintenance/Navigator) extended.

Verified: tsc exit 0, vitest 48/48, next build exit 0 (57 page routes).

src/actions/admin-alerts.ts

@@ -0,0 +1,27 @@
+"use server";
+
+import { revalidatePath } from "next/cache";
+import { requireStaff } from "@/lib/admin/guard";
+import { rcon } from "@/lib/services/rcon";
+
+/**
+ * Broadcast a hotel-wide alert to every online user via RCON.
+ *
+ * Faithful to AtomCMS: the emulator's `hotelalert` command takes a single
+ * `message` payload. Staff-gated; the message is trimmed/bounded before send.
+ */
+export async function sendHotelAlert(formData: FormData): Promise<void> {
+  await requireStaff();
+
+  const message = String(formData.get("message") ?? "").trim().slice(0, 1000);
+  if (!message) return;
+
+  try {
+    await rcon.send("hotelalert", { message });
+  } catch {
+    // Best-effort delivery (dead socket / emulator offline) — never 500 the
+    // admin page. The emulator writes its own alert_logs row on receipt.
+  }
+
+  revalidatePath("/admin/alerts");
+}

src/actions/admin-maintenance.ts

@@ -0,0 +1,57 @@
+"use server";
+
+import { revalidatePath } from "next/cache";
+import { requireStaff } from "@/lib/admin/guard";
+import { prisma } from "@/lib/prisma";
+import { siteSettings } from "@/lib/services/site-settings";
+
+// Maintenance mode lives in three CMS-owned website_settings rows (mirrors
+// AtomCMS's MaintenanceToggle Livewire component):
+//   maintenance_enabled        '1' | '0'
+//   maintenance_message        free text (HTML allowed, shown on the splash)
+//   min_maintenance_login_rank int as string (min rank that may still log in)
+// The Laravel login flow reads these via setting() to gate non-staff logins
+// while maintenance is on, so the website_settings keys are the source of truth.
+
+const KEY_ENABLED = "maintenance_enabled";
+const KEY_MESSAGE = "maintenance_message";
+const KEY_MIN_RANK = "min_maintenance_login_rank";
+
+const COMMENTS: Record<string, string> = {
+  [KEY_ENABLED]: "Determines whether maintenance is enabled or not",
+  [KEY_MESSAGE]:
+    "The maintenance message displayed to users while maintenance is activated",
+  [KEY_MIN_RANK]:
+    "The minimum rank required to login to the hotel during maintenance",
+};
+
+async function upsertSetting(key: string, value: string): Promise<void> {
+  await prisma.websiteSetting.upsert({
+    where: { key },
+    update: { value },
+    create: { key, value, comment: COMMENTS[key] ?? null },
+  });
+}
+
+export async function saveMaintenance(formData: FormData): Promise<void> {
+  await requireStaff();
+
+  // Checkbox: present only when ticked. Normalise to the '1'/'0' string the
+  // emulator/Laravel side expects.
+  const enabled = formData.get("enabled") != null ? "1" : "0";
+
+  const message = String(formData.get("message") ?? "");
+
+  // Coerce the rank to a non-negative integer; fall back to AtomCMS's default
+  // of 5 when the field is blank or garbage.
+  const rawRank = String(formData.get("min_rank") ?? "").trim();
+  const parsedRank = Number.parseInt(rawRank, 10);
+  const minRank = Number.isFinite(parsedRank) && parsedRank >= 0 ? parsedRank : 5;
+
+  await upsertSetting(KEY_ENABLED, enabled);
+  await upsertSetting(KEY_MESSAGE, message);
+  await upsertSetting(KEY_MIN_RANK, String(minRank));
+
+  siteSettings.reload();
+  revalidatePath("/admin/maintenance");
+}