Security hardening: 12 improvements across the stack

1. env.ts: APP_KEY placeholder detection with validation
2. schema.prisma: password column widened to varchar(255) for argon2id
3. auth.ts: trustHost restricted to development only
4. next.config.ts: added CSP, HSTS, X-Frame-Options, and other security headers
5. api.ts: CORS restricted to APP_URL instead of wildcard
6. register-form.tsx: migrated from REST API fetch to server action (useActionState)
7. twofactor.ts + 2fa page: TOTP recovery codes (8 one-time codes, generated and displayed)
8. register.ts: password min length 8 + complexity requirements (upper, lower, digit)
9. register.ts + help-tickets.ts + radio-shouts.ts: Zod schema validation
10. rate-limit.ts: improved periodic cleanup with aggressive eviction at 10k buckets
11. guard.ts + admin actions: rate-limited admin actions (30 req/min per staff)
12. help-tickets.ts + radio-shouts.ts: content moderation via moderateOrThrow

src/lib/api.ts

@@ -2,17 +2,18 @@ import { NextResponse } from "next/server";
 
 /**
  * JSON response helper for the public REST API. Serialises BigInt (Prisma ids)
- * to strings — JSON.stringify throws on BigInt otherwise — and sets permissive
- * CORS so the game client / external integrations can read it (mirrors the
- * AtomCMS API CORS config).
+ * to strings — JSON.stringify throws on BigInt otherwise — and sets CORS to
+ * APP_URL so the game client / external integrations can read it.
  */
+const CORS_ORIGIN = process.env.APP_URL ?? "http://localhost:3000";
+
 export function apiJson(data: unknown, init?: ResponseInit): NextResponse {
   const body = JSON.stringify(data, (_k, v) => (typeof v === "bigint" ? v.toString() : v));
   return new NextResponse(body, {
     status: init?.status ?? 200,
     headers: {
       "content-type": "application/json; charset=utf-8",
-      "access-control-allow-origin": "*",
+      "access-control-allow-origin": CORS_ORIGIN,
       "cache-control": "no-store",
       ...(init?.headers ?? {}),
     },