feat: harden atoms-nexst against review findings (37 items)

Second review pass covering security, performance, admin tooling and the
public/room flows. All HIGH and MEDIUM findings from the audit are resolved;
nothing in this commit changes the visible feature set.

Authentication & session security
- CSP is now set on the request headers in the proxy, which is what Next.js
  uses to derive the render nonce, so the nonce is effective.
- 2FA: an already-enabled user cannot re-enroll, the setup endpoint is
  rate-limited per account, and confirmed codes are persisted so the second
  secret no longer silently never applies.
- Password reset revokes the ticket, authTicket and all personal access
  tokens, and bumps the token version so existing sessions die. The same
  revocation is now wired into the staff-side password reset.
- /reset and /verify return a stable error code instead of raw text; the
  mail lookups are ordered by id so duplicates cannot vary between runs.
- Resending the verification mail gets a per-address cooldown on top of the
  per-user limit.
- Issue API tokens with the narrower radio/ticket ability set instead of "*".

Authorization & input handling
- Mid-rank staff can no longer keep dynamically granted non-view admin.*
  permissions: existing grants are revoked by migration and the grant lookup
  is restricted to "%.view". Rank guards use the dynamic super-admin check.
- Alerting a user is permission-checked and audited like the other tools.
- Material mutations (giveCredits/giveDuckets/giveDiamonds, the admin user
  actions route, bulk user actions) are capped and rank-guarded, and bulk
  ids are bounded.
- updateRoom / updateRoomItem write through a field allowlist, and items
  may only be edited through their own room.
- Classnames reaching the filesystem are validated before use so a crafted
  value cannot escape the asset directories.
- The word filter now also covers offline mails, guild forum threads and
  replies, and user mottos.
- Media uploads are validated by magic bytes, /api/media requires the page
  edit permission, APP_URL must be configured once mail is enabled, and the
  diagnostics error route checks the fetch site header.

Admin tooling
- Secret settings render masked and cannot be overwritten with a blank or
  an arbitrary raw key; radio credentials are new password inputs.
- Commandocentrum balance changes are audited.
- Admin list pagination reads the caller's per-page instead of the max, and
  the log exporter caps offset and search length.

Performance
- Catalog translations are cached per module, with a cheap revision hash;
  the public online count uses a stale window instead of hammering the DB.
- The cache warmup now primes the payload the home route actually reads.
- TopHeader batches its queries into one round trip, and LCP avatars load
  eagerly.
- motion/react and sonner are no longer part of the root layout; the nav
  dropdown and mobile nav panels are lazy client chunks. Anonymous visitors
  again get the navigation chrome, and public pages get an edge cacheable
  response.

Accessibility
- Nested <main> elements in phase pages became <section>; the page entrance
  and route progress animations are pure CSS that respect reduced motion.

src/actions/password-reset.ts

@@ -1,11 +1,14 @@
 "use server";
 
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
-import { eq } from "drizzle-orm";
+import { asc, eq } from "drizzle-orm";
 import { redirect } from "next/navigation";
 import { env } from "@/env";
+import { invalidateLoginCache } from "@/lib/auth/login-core";
 import { hashPassword } from "@/lib/auth/password";
+import { revokeUserCredentials } from "@/lib/auth/session-revocation";
 import { db, PasswordReset, User } from "@/lib/db";
+import { logger } from "@/lib/logger";
 import { clientIp, rateLimit } from "@/lib/rate-limit";
 import { logServerError } from "@/lib/server-log";
 import { captchaConfig, verifyCaptcha } from "@/lib/services/captcha";
@@ -17,6 +20,17 @@ function sha256(s: string): string {
 	return createHash("sha256").update(s).digest("hex");
 }
 
+/**
+ * Back to the reset form with a *code*, never with the human-readable message:
+ * a raw `?error=` value would be rendered on our own domain, which is a
+ * perfect phishing skeleton. The page maps each code to a translation.
+ */
+function errorRedirect(email: string, token: string, code: string): never {
+	return redirect(
+		`/reset?email=${encodeURIComponent(email)}&token=${encodeURIComponent(token)}&error=${code}`,
+	);
+}
+
 export async function requestReset(formData: FormData): Promise<void> {
 	const email = String(formData.get("email") ?? "")
 		.normalize("NFC")
@@ -40,12 +54,23 @@ export async function requestReset(formData: FormData): Promise<void> {
 	// Always respond the same way so we don't reveal which emails exist.
 	if (allowed && /^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) {
 		try {
-			const [user] = await db
+			const matches = await db
 				.select({ id: User.id })
 				.from(User)
 				.where(eq(User.mail, email))
-				.limit(1);
+				.orderBy(asc(User.id));
+			if (matches.length > 1) {
+				logger.warn("Password reset address is not unique", {
+					email,
+					accountCount: matches.length,
+					using: matches[0]?.id,
+				});
+			}
+			const user = matches[0];
 			if (user) {
+				// Duplicate addresses exist on legacy databases; resetting the
+				// *oldest* account keeps the choice deterministic instead of
+				// "whatever row the engine returns first".
 				const token = randomBytes(32).toString("hex");
 				const hashed = sha256(token);
 				const createdAt = new Date();
@@ -80,13 +105,11 @@ export async function resetPassword(formData: FormData): Promise<void> {
 
 	// Throttle reset attempts per IP (5 per 15 min) to prevent token brute-force.
 	if (!(await rateLimit(`resetpwd:${await clientIp()}`, 5, 15 * 60_000)).ok) {
-		redirect(
-			`/reset?email=${encodeURIComponent(email)}&token=${encodeURIComponent(token)}&error=${encodeURIComponent("Too many attempts — try again later")}`,
-		);
+		redirect(errorRedirect(email, token, "ratelimit"));
 	}
 
-	let error: string | null = null;
-	if (password.length < 12) error = "Password must be at least 12 characters";
+	let error: "password" | "invalid" | "failed" | null = null;
+	if (password.length < 12) error = "password";
 
 	if (!error) {
 		try {
@@ -107,20 +130,29 @@ export async function resetPassword(formData: FormData): Promise<void> {
 				row != null && a.length === b.length && timingSafeEqual(a, b);
 
 			if (!row || !fresh || !match) {
-				error = "This reset link is invalid or has expired";
+				error = "invalid";
 			} else {
-				const [user] = await db
+				const matches = await db
 					.select({ id: User.id })
 					.from(User)
 					.where(eq(User.mail, email))
-					.limit(1);
+					.orderBy(asc(User.id));
+				const user = matches[0];
 				if (!user) {
-					error = "Account not found";
+					error = "invalid";
 				} else {
-					await db
-						.update(User)
-						.set({ password: await hashPassword(password) })
-						.where(eq(User.id, user.id));
+					const newHash = await hashPassword(password);
+					// A password change has to end every existing session: the
+					// popular reason for resetting is a compromised account, and a
+					// stolen cookie/API token must not outlive the reset.
+					await Promise.all([
+						db
+							.update(User)
+							.set({ password: newHash })
+							.where(eq(User.id, user.id)),
+						revokeUserCredentials(user.id),
+					]);
+					await invalidateLoginCache(email);
 					await db
 						.delete(PasswordReset)
 						.where(eq(PasswordReset.email, email))
@@ -132,14 +164,12 @@ export async function resetPassword(formData: FormData): Promise<void> {
 				}
 			}
 		} catch {
-			error = "Could not reset the password — try again";
+			error = "failed";
 		}
 	}
 
 	if (error) {
-		redirect(
-			`/reset?email=${encodeURIComponent(email)}&token=${encodeURIComponent(token)}&error=${encodeURIComponent(error)}`,
-		);
+		redirect(errorRedirect(email, token, error));
 	}
 	redirect("/login?reset=1");
 }