Add social login (Discord/Google) + batch-6 pages

Auth: NextAuth Discord + Google providers (enabled when env id+secret set);
OAuth signIn allowed only if a hotel account matches the email; jwt binds the
session to that account (id/rank/username). Login page gets social buttons.

Batch 6 (parallel agents): /friends (messenger_friendships), /guilds/[id]/forum
(threads), /admin/navigation (navigator config), /admin/maintenance (toggle
maintenance settings), /admin/alerts (alert_logs + send hotel alert via RCON).
Header (Friends) + admin nav (Alerts/Maintenance/Navigator) extended.

Verified: tsc exit 0, vitest 48/48, next build exit 0 (57 page routes).

src/env.ts

@@ -17,6 +17,13 @@ const schema = z.object({
   RCON_MAX_RETRIES: z.coerce.number().int().positive().default(3),
   // NextAuth v5 reads AUTH_SECRET itself; declared here for documentation/typing.
   AUTH_SECRET: z.string().min(1).optional(),
+  // Laravel APP_KEY (base64:...) — needed to read existing 2FA secrets.
+  APP_KEY: z.string().optional(),
+  // Optional OAuth providers (enabled only when both id+secret are set).
+  DISCORD_CLIENT_ID: z.string().optional(),
+  DISCORD_CLIENT_SECRET: z.string().optional(),
+  GOOGLE_CLIENT_ID: z.string().optional(),
+  GOOGLE_CLIENT_SECRET: z.string().optional(),
   // Mirrors Laravel config('habbo.site.convert_passwords') — enables md5->argon2id.
   CONVERT_PASSWORDS: z
     .string()