Security hardening: 12 improvements across the stack

1. env.ts: APP_KEY placeholder detection with validation
2. schema.prisma: password column widened to varchar(255) for argon2id
3. auth.ts: trustHost restricted to development only
4. next.config.ts: added CSP, HSTS, X-Frame-Options, and other security headers
5. api.ts: CORS restricted to APP_URL instead of wildcard
6. register-form.tsx: migrated from REST API fetch to server action (useActionState)
7. twofactor.ts + 2fa page: TOTP recovery codes (8 one-time codes, generated and displayed)
8. register.ts: password min length 8 + complexity requirements (upper, lower, digit)
9. register.ts + help-tickets.ts + radio-shouts.ts: Zod schema validation
10. rate-limit.ts: improved periodic cleanup with aggressive eviction at 10k buckets
11. guard.ts + admin actions: rate-limited admin actions (30 req/min per staff)
12. help-tickets.ts + radio-shouts.ts: content moderation via moderateOrThrow

src/lib/auth/password.ts

@@ -14,10 +14,8 @@ const ARGON2_PARAMS = {
 const BCRYPT_ROUNDS = 12;
 
 // Which algorithm hashPassword() emits for NEW/upgraded passwords.
-//   - "bcrypt"  (DEFAULT): 60-char $2y$ hash. Fits a varchar(64) users.password
-//     (the common emulator/AtomCMS column width) and matches existing accounts.
-//   - "argon2id": ~97-char PHC hash. ONLY usable if users.password is widened
-//     (e.g. varchar(255)). Opt in with PASSWORD_HASH=argon2id.
+//   - "bcrypt"  (DEFAULT): 60-char $2y$ hash. Fits varchar(255) users.password.
+//   - "argon2id": ~97-char PHC hash. Opt in with PASSWORD_HASH=argon2id.
 // verifyPassword() always accepts BOTH, so logins keep working either way.
 function hashDriver(): "bcrypt" | "argon2id" {
   return process.env.PASSWORD_HASH?.toLowerCase() === "argon2id" ? "argon2id" : "bcrypt";