perf: add bans.user_id index, Redis cache layer, rate-limit improvements, radio contest/giveaway columns, and tests

- Add DB index on bans.user_id to speed up per-request ban lookups (migration 0008)
- Replace in-process rate limiter with Redis-backed implementation with in-memory fallback
- Add Redis caching layer for site settings with TTL invalidation (migration 0009)
- Add rate limiting to resetPassword to prevent token brute-force attacks
- Update all rateLimit callers to await the now-async function
- Flesh out RadioContests and RadioGiveaways models with title, description, prize, date, and winner columns
- Update radio contest/giveaway pages to display new fields
- Add tests for rate limiter (4 tests) and password-reset actions (3 tests)
- Add REDIS_URL environment variable (optional, falls back to in-memory)

src/actions/password-reset.ts

@@ -18,7 +18,7 @@ export async function requestReset(formData: FormData): Promise<void> {
   const email = String(formData.get("email") ?? "").trim().toLowerCase();
 
   // Throttle reset requests per IP (3 per 15 min) to curb email-bomb abuse.
-  const allowed = rateLimit(`reset:${await clientIp()}`, 3, 15 * 60_000).ok;
+  const allowed = (await rateLimit(`reset:${await clientIp()}`, 3, 15 * 60_000)).ok;
 
   // Always respond the same way so we don't reveal which emails exist.
   if (allowed && /^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) {
@@ -51,6 +51,11 @@ export async function resetPassword(formData: FormData): Promise<void> {
   const token = String(formData.get("token") ?? "").trim();
   const password = String(formData.get("password") ?? "");
 
+  // Throttle reset attempts per IP (5 per 15 min) to prevent token brute-force.
+  if (!(await rateLimit(`resetpwd:${await clientIp()}`, 5, 15 * 60_000)).ok) {
+    redirect(`/reset?email=${encodeURIComponent(email)}&token=${encodeURIComponent(token)}&error=${encodeURIComponent("Too many attempts — try again later")}`);
+  }
+
   let error: string | null = null;
   if (password.length < 6) error = "Password must be at least 6 characters";