Security hardening: 12 improvements across the stack

1. env.ts: APP_KEY placeholder detection with validation
2. schema.prisma: password column widened to varchar(255) for argon2id
3. auth.ts: trustHost restricted to development only
4. next.config.ts: added CSP, HSTS, X-Frame-Options, and other security headers
5. api.ts: CORS restricted to APP_URL instead of wildcard
6. register-form.tsx: migrated from REST API fetch to server action (useActionState)
7. twofactor.ts + 2fa page: TOTP recovery codes (8 one-time codes, generated and displayed)
8. register.ts: password min length 8 + complexity requirements (upper, lower, digit)
9. register.ts + help-tickets.ts + radio-shouts.ts: Zod schema validation
10. rate-limit.ts: improved periodic cleanup with aggressive eviction at 10k buckets
11. guard.ts + admin actions: rate-limited admin actions (30 req/min per staff)
12. help-tickets.ts + radio-shouts.ts: content moderation via moderateOrThrow

src/env.ts

@@ -29,7 +29,20 @@ const schema = z.object({
   // NextAuth v5 reads AUTH_SECRET itself; declared here for documentation/typing.
   AUTH_SECRET: z.string().min(1).optional(),
   // Laravel APP_KEY (base64:...) — needed to read existing 2FA secrets.
-  APP_KEY: z.string().optional(),
+  APP_KEY: z.string().optional().refine(
+    (v) => {
+      if (!v) return true;
+      if (v.startsWith("base64:")) {
+        try {
+          const decoded = atob(v.slice(7));
+          // Catch the known placeholder key
+          if (decoded.includes("placeholder")) return false;
+        } catch { return false; }
+      }
+      return v.length >= 16;
+    },
+    { message: "APP_KEY is a placeholder or invalid — generate a real 32-byte key: echo 'base64:'$(openssl rand -base64 32)" },
+  ),
   // Optional OAuth providers (enabled only when both id+secret are set).
   DISCORD_CLIENT_ID: z.string().optional(),
   DISCORD_CLIENT_SECRET: z.string().optional(),