Security hardening: 12 improvements across the stack

1. env.ts: APP_KEY placeholder detection with validation
2. schema.prisma: password column widened to varchar(255) for argon2id
3. auth.ts: trustHost restricted to development only
4. next.config.ts: added CSP, HSTS, X-Frame-Options, and other security headers
5. api.ts: CORS restricted to APP_URL instead of wildcard
6. register-form.tsx: migrated from REST API fetch to server action (useActionState)
7. twofactor.ts + 2fa page: TOTP recovery codes (8 one-time codes, generated and displayed)
8. register.ts: password min length 8 + complexity requirements (upper, lower, digit)
9. register.ts + help-tickets.ts + radio-shouts.ts: Zod schema validation
10. rate-limit.ts: improved periodic cleanup with aggressive eviction at 10k buckets
11. guard.ts + admin actions: rate-limited admin actions (30 req/min per staff)
12. help-tickets.ts + radio-shouts.ts: content moderation via moderateOrThrow

prisma/schema.prisma

@@ -35,7 +35,7 @@ model User {
   id                Int          @id @default(autoincrement())
   username          String       @unique(map: "username") @db.VarChar(25)
   realName          String       @default("KREWS DEV") @map("real_name") @db.VarChar(25)
-  password          String       @db.VarChar(64)
+  password          String       @db.VarChar(255)
   mail              String?      @db.VarChar(500)
   mailVerified      String       @default("0") @map("mail_verified")
   accountCreated    Int          @map("account_created")