feat: harden atoms-nexst against review findings (37 items)

Second review pass covering security, performance, admin tooling and the
public/room flows. All HIGH and MEDIUM findings from the audit are resolved;
nothing in this commit changes the visible feature set.

Authentication & session security
- CSP is now set on the request headers in the proxy, which is what Next.js
  uses to derive the render nonce, so the nonce is effective.
- 2FA: an already-enabled user cannot re-enroll, the setup endpoint is
  rate-limited per account, and confirmed codes are persisted so the second
  secret no longer silently never applies.
- Password reset revokes the ticket, authTicket and all personal access
  tokens, and bumps the token version so existing sessions die. The same
  revocation is now wired into the staff-side password reset.
- /reset and /verify return a stable error code instead of raw text; the
  mail lookups are ordered by id so duplicates cannot vary between runs.
- Resending the verification mail gets a per-address cooldown on top of the
  per-user limit.
- Issue API tokens with the narrower radio/ticket ability set instead of "*".

Authorization & input handling
- Mid-rank staff can no longer keep dynamically granted non-view admin.*
  permissions: existing grants are revoked by migration and the grant lookup
  is restricted to "%.view". Rank guards use the dynamic super-admin check.
- Alerting a user is permission-checked and audited like the other tools.
- Material mutations (giveCredits/giveDuckets/giveDiamonds, the admin user
  actions route, bulk user actions) are capped and rank-guarded, and bulk
  ids are bounded.
- updateRoom / updateRoomItem write through a field allowlist, and items
  may only be edited through their own room.
- Classnames reaching the filesystem are validated before use so a crafted
  value cannot escape the asset directories.
- The word filter now also covers offline mails, guild forum threads and
  replies, and user mottos.
- Media uploads are validated by magic bytes, /api/media requires the page
  edit permission, APP_URL must be configured once mail is enabled, and the
  diagnostics error route checks the fetch site header.

Admin tooling
- Secret settings render masked and cannot be overwritten with a blank or
  an arbitrary raw key; radio credentials are new password inputs.
- Commandocentrum balance changes are audited.
- Admin list pagination reads the caller's per-page instead of the max, and
  the log exporter caps offset and search length.

Performance
- Catalog translations are cached per module, with a cheap revision hash;
  the public online count uses a stale window instead of hammering the DB.
- The cache warmup now primes the payload the home route actually reads.
- TopHeader batches its queries into one round trip, and LCP avatars load
  eagerly.
- motion/react and sonner are no longer part of the root layout; the nav
  dropdown and mobile nav panels are lazy client chunks. Anonymous visitors
  again get the navigation chrome, and public pages get an edge cacheable
  response.

Accessibility
- Nested <main> elements in phase pages became <section>; the page entrance
  and route progress animations are pure CSS that respect reduced motion.

src/app/admin/layout.tsx

@@ -6,6 +6,7 @@ import type { ReactNode } from "react";
 import { AdminHubChrome } from "@/components/admin/admin-hub-chrome";
 import { AdminMobileWrapper } from "@/components/admin/admin-mobile-wrapper";
 import { AdminSidebarNav } from "@/components/admin/admin-sidebar-nav";
+import { AdminToaster } from "@/components/admin/admin-toaster";
 import { AdminTopbar } from "@/components/admin/admin-topbar";
 import { LanguageSwitcher } from "@/components/language-switcher";
 import Link from "@/components/link";
@@ -54,6 +55,7 @@ export default async function AdminLayout({
 					</section>
 				</div>
 			</AdminMobileWrapper>
+			<AdminToaster />
 		</>
 	);
 }

src/app/admin/logs/_lib/load-ignored-logs.ts

@@ -32,7 +32,8 @@ function parsePageParams(
 ) {
 	const sp = new URLSearchParams(rawParams);
 	const parsed = parseListParams(sp);
-	const perPage = Number(rawParams.perPage) || defaultPerPage;
+	// parseListParams clamps perPage to 1..100 — use it instead of the raw value.
+	const perPage = parsed.perPage || defaultPerPage;
 	return { search: parsed.search.trim(), page: parsed.page, perPage };
 }
 
@@ -63,8 +64,10 @@ async function loadLogList<RawRow, Row>(
 		rawParams,
 		input.defaultPerPage ?? 50,
 	);
-	const offset = (page - 1) * perPage;
-	const like = `%${search}%`;
+	// Cap the offset: `?page=1000000` otherwise builds a multi-hundred-million
+	// row scan before returning an empty page.
+	const offset = Math.min((page - 1) * perPage, 100_000);
+	const like = `%${search.slice(0, 100)}%`;
 	const where = search ? sql`WHERE ${spec.searchWhere(like)}` : sql``;
 
 	const [rawRowsResult, countRows] = await Promise.all([

src/app/admin/radio/settings/page.tsx

@@ -7,7 +7,7 @@ import { StatusCard } from "@/components/admin/dashboard";
 import { Button } from "@/components/ui/button";
 import { db, WebsiteSetting } from "@/lib/db";
 
-type Field = { key: string; comment: string };
+type Field = { key: string; comment: string; secret?: boolean };
 type Group = { title: string; fields: Field[] };
 
 const GROUPS: Group[] = [
@@ -19,7 +19,11 @@ const GROUPS: Group[] = [
 			{ key: "radio_stream_backup_url", comment: "Backup stream URL" },
 			{ key: "radio_azurecast_base_url", comment: "AzureCast base URL" },
 			{ key: "radio_azurecast_station_id", comment: "AzureCast station ID" },
-			{ key: "radio_azurecast_api_key", comment: "AzureCast API key" },
+			{
+				key: "radio_azurecast_api_key",
+				comment: "AzureCast API key",
+				secret: true,
+			},
 			{ key: "radio_azurecast_port", comment: "AzureCast stream port" },
 			{
 				key: "radio_azurecast_protocol",
@@ -41,9 +45,14 @@ const GROUPS: Group[] = [
 			{
 				key: "radio_sambroadcaster_password",
 				comment: "Sambroadcaster password",
+				secret: true,
 			},
 			{ key: "radio_virtual_dj_url", comment: "Virtual DJ URL" },
-			{ key: "radio_virtual_dj_password", comment: "Virtual DJ password" },
+			{
+				key: "radio_virtual_dj_password",
+				comment: "Virtual DJ password",
+				secret: true,
+			},
 			{ key: "radio_djs_api_url", comment: "DJs API URL" },
 		],
 	},
@@ -331,7 +340,11 @@ const GROUPS: Group[] = [
 	{
 		title: "Discord webhook & custom code",
 		fields: [
-			{ key: "radio_discord_webhook_url", comment: "Discord webhook URL" },
+			{
+				key: "radio_discord_webhook_url",
+				comment: "Discord webhook URL",
+				secret: true,
+			},
 			{
 				key: "radio_discord_enabled",
 				comment: "Enable Discord notifications (0=no, 1=yes)",
@@ -467,7 +480,15 @@ export default async function AdminRadioSettingsPage() {
 									<input
 										id={`f_${field.key}`}
 										name={field.key}
-										defaultValue={values.get(field.key) ?? ""}
+										// Credentials are masked and blank means "keep".
+										type={field.secret ? "password" : "text"}
+										autoComplete="off"
+										placeholder={
+											field.secret ? "Leave blank to keep" : undefined
+										}
+										defaultValue={
+											field.secret ? "" : (values.get(field.key) ?? "")
+										}
 										style={{ width: "100%" }}
 									/>
 									{field.comment ? (

src/app/admin/settings/advanced-settings-panel.tsx

@@ -14,8 +14,10 @@ import { MANAGED_SETTING_KEYS } from "./cms-settings-config";
 
 interface SettingRow {
 	key: string;
+	/** Masked for secrets — the real value never reaches the client. */
 	value: string;
 	comment: string | null;
+	secret?: boolean;
 }
 
 export function AdvancedSettingsPanel({
@@ -126,7 +128,7 @@ export function AdvancedSettingsPanel({
 									</>
 								) : (
 									<code className="flex-1 text-xs break-all text-muted-foreground">
-										{s.value}
+										{s.secret ? "•• hidden ••" : s.value}
 									</code>
 								)}
 							</div>

src/app/admin/settings/page.tsx

@@ -5,6 +5,10 @@ import { getTranslations } from "next-intl/server";
 import { AdminPageShell } from "@/components/admin/admin-page-shell";
 import { db, WebsiteSetting } from "@/lib/db";
 import { canAccess, getAdminContext, PERMS } from "@/lib/permissions";
+import {
+	isSecretSettingKey,
+	SECRET_PLACEHOLDER,
+} from "@/lib/services/setting-secrets";
 import { AdvancedSettingsPanel } from "./advanced-settings-panel";
 import { FIELD_DEFAULTS, MANAGED_SETTING_KEYS } from "./cms-settings-config";
 import { CmsSettingsForm } from "./cms-settings-form";
@@ -61,10 +65,14 @@ export default async function AdminSettings() {
 				<CmsSettingsForm values={values} canEdit={canEdit} />
 
 				<AdvancedSettingsPanel
+					// Credentials never leave the server: a reader with only
+					// SETTINGS_VIEW must not receive captcha/radio secrets in the
+					// payload, and an editor sees a "keep stored value" placeholder.
 					settings={settings.map((s) => ({
 						key: s.key,
-						value: s.value,
+						value: isSecretSettingKey(s.key) ? SECRET_PLACEHOLDER : s.value,
 						comment: s.comment,
+						secret: isSecretSettingKey(s.key),
 					}))}
 					canEdit={canEdit}
 				/>