101%: app-level DDoS guard, PWA, /api/health, API docs, worker JAR backup

Beyond parity — the web-feasible versions of the "host-only" items plus
extras AtomCMS doesn't have:
- App-level abuse/DDoS guard (src/lib/services/abuse-guard.ts): counts
  requests per IP and auto-adds flooders to website_ip_blacklist (enforced
  by the access guard) + fires ddosDetected(). OFF by default, tunable via
  settings. The iptables layer stays host-only; this is the real app-tier
  mitigation. Access guard now also enforces the IP blacklist (cached).
- PWA: a themeable web manifest (src/app/manifest.ts) + a service worker
  (public/sw.js, cache-first assets / network-first pages) registered after
  hydration — the hotel is now installable.
- /api/health: DB + emulator(RCON) + runtime status probe.
- /developers: a public API documentation page covering every REST endpoint
  with its method, path and auth requirement.
- jobs-worker: daily emulator JAR backup (runs host-side in the worker, like
  AtomCMS's backup command) — copies + prunes; no-ops unless EMULATOR_JAR_PATH
  + EMULATOR_BACKUP_DIR are set.

Verified live (prod, amx_test): /api/health ok, manifest + sw served, docs
page renders, normal pages unaffected by the guard. tsc 0, vitest 49/49,
next build 0.

src/app/api/health/route.ts

@@ -0,0 +1,26 @@
+import { apiJson } from "@/lib/api";
+import { prisma } from "@/lib/prisma";
+import { rcon } from "@/lib/services/rcon";
+
+export const dynamic = "force-dynamic";
+
+/**
+ * Ops health probe: database reachability, emulator RCON reachability, and
+ * runtime info. Returns HTTP 200 always (read the `status`/`database` fields),
+ * so it's safe for uptime monitors that only care about reachability.
+ */
+export async function GET() {
+  const database = await prisma
+    .$queryRaw`SELECT 1`.then(() => true)
+    .catch(() => false);
+  const emulator = await rcon.send("ping", null).catch(() => false);
+
+  return apiJson({
+    status: database ? "ok" : "degraded",
+    database,
+    emulator,
+    node: process.version,
+    uptime: Math.round(process.uptime()),
+    time: new Date().toISOString(),
+  });
+}