Security hardening: 12 improvements across the stack

1. env.ts: APP_KEY placeholder detection with validation
2. schema.prisma: password column widened to varchar(255) for argon2id
3. auth.ts: trustHost restricted to development only
4. next.config.ts: added CSP, HSTS, X-Frame-Options, and other security headers
5. api.ts: CORS restricted to APP_URL instead of wildcard
6. register-form.tsx: migrated from REST API fetch to server action (useActionState)
7. twofactor.ts + 2fa page: TOTP recovery codes (8 one-time codes, generated and displayed)
8. register.ts: password min length 8 + complexity requirements (upper, lower, digit)
9. register.ts + help-tickets.ts + radio-shouts.ts: Zod schema validation
10. rate-limit.ts: improved periodic cleanup with aggressive eviction at 10k buckets
11. guard.ts + admin actions: rate-limited admin actions (30 req/min per staff)
12. help-tickets.ts + radio-shouts.ts: content moderation via moderateOrThrow

src/actions/help-tickets.ts

@@ -1,8 +1,16 @@
 "use server";
 
 import { revalidatePath } from "next/cache";
+import { z } from "zod";
 import { auth } from "@/lib/auth";
 import { prisma } from "@/lib/prisma";
+import { moderateOrThrow } from "@/lib/services/moderation";
+import { clientIp, rateLimit } from "@/lib/rate-limit";
+
+const ticketSchema = z.object({
+  title: z.string().min(1, "Title is required").max(255),
+  content: z.string().min(1, "Content is required").max(5000),
+});
 
 export async function createTicket(formData: FormData): Promise<void> {
   // Re-read the session user id server-side; never trust a form-supplied id.
@@ -10,9 +18,25 @@ export async function createTicket(formData: FormData): Promise<void> {
   const userId = Number(session?.user?.id);
   if (!Number.isInteger(userId) || userId <= 0) return;
 
-  const title = String(formData.get("title") ?? "").trim().slice(0, 255);
-  const content = String(formData.get("content") ?? "").trim().slice(0, 5000);
-  if (!title || !content) return;
+  const ip = await clientIp();
+  if (!rateLimit(`ticket:${userId}`, 3, 60_000).ok) return;
+
+  const raw = {
+    title: String(formData.get("title") ?? "").trim().slice(0, 255),
+    content: String(formData.get("content") ?? "").trim().slice(0, 5000),
+  };
+
+  const parsed = ticketSchema.safeParse(raw);
+  if (!parsed.success) return;
+
+  const { title, content } = parsed.data;
+
+  // Moderation check
+  try {
+    await moderateOrThrow(`${title} ${content}`);
+  } catch {
+    return;
+  }
 
   const now = new Date();
   await prisma.websiteHelpCenterTickets.create({