Security hardening: 12 improvements across the stack

1. env.ts: APP_KEY placeholder detection with validation
2. schema.prisma: password column widened to varchar(255) for argon2id
3. auth.ts: trustHost restricted to development only
4. next.config.ts: added CSP, HSTS, X-Frame-Options, and other security headers
5. api.ts: CORS restricted to APP_URL instead of wildcard
6. register-form.tsx: migrated from REST API fetch to server action (useActionState)
7. twofactor.ts + 2fa page: TOTP recovery codes (8 one-time codes, generated and displayed)
8. register.ts: password min length 8 + complexity requirements (upper, lower, digit)
9. register.ts + help-tickets.ts + radio-shouts.ts: Zod schema validation
10. rate-limit.ts: improved periodic cleanup with aggressive eviction at 10k buckets
11. guard.ts + admin actions: rate-limited admin actions (30 req/min per staff)
12. help-tickets.ts + radio-shouts.ts: content moderation via moderateOrThrow

src/actions/radio-shouts.ts

@@ -1,11 +1,15 @@
 "use server";
 
 import { revalidatePath } from "next/cache";
+import { z } from "zod";
 import { auth } from "@/lib/auth";
 import { prisma } from "@/lib/prisma";
+import { moderateOrThrow } from "@/lib/services/moderation";
+import { clientIp, rateLimit } from "@/lib/rate-limit";
 
-// radio_shouts.message is TEXT, but cap the write to keep shouts tweet-sized.
-const MESSAGE_MAX = 255;
+const shoutSchema = z.object({
+  message: z.string().min(1, "Message is required").max(255),
+});
 
 /**
  * Post a radio shout.
@@ -20,10 +24,24 @@ export async function postShout(formData: FormData): Promise<void> {
   const userId = Number(session?.user?.id);
   if (!Number.isInteger(userId) || userId <= 0) return;
 
-  const message = String(formData.get("message") ?? "")
-    .trim()
-    .slice(0, MESSAGE_MAX);
-  if (!message) return;
+  const ip = await clientIp();
+  if (!rateLimit(`shout:${userId}`, 5, 30_000).ok) return;
+
+  const raw = {
+    message: String(formData.get("message") ?? "").trim().slice(0, 255),
+  };
+
+  const parsed = shoutSchema.safeParse(raw);
+  if (!parsed.success) return;
+
+  const { message } = parsed.data;
+
+  // Moderation check
+  try {
+    await moderateOrThrow(message);
+  } catch {
+    return;
+  }
 
   const now = new Date();
   try {