feat: harden atoms-nexst against review findings (37 items)

Second review pass covering security, performance, admin tooling and the
public/room flows. All HIGH and MEDIUM findings from the audit are resolved;
nothing in this commit changes the visible feature set.

Authentication & session security
- CSP is now set on the request headers in the proxy, which is what Next.js
  uses to derive the render nonce, so the nonce is effective.
- 2FA: an already-enabled user cannot re-enroll, the setup endpoint is
  rate-limited per account, and confirmed codes are persisted so the second
  secret no longer silently never applies.
- Password reset revokes the ticket, authTicket and all personal access
  tokens, and bumps the token version so existing sessions die. The same
  revocation is now wired into the staff-side password reset.
- /reset and /verify return a stable error code instead of raw text; the
  mail lookups are ordered by id so duplicates cannot vary between runs.
- Resending the verification mail gets a per-address cooldown on top of the
  per-user limit.
- Issue API tokens with the narrower radio/ticket ability set instead of "*".

Authorization & input handling
- Mid-rank staff can no longer keep dynamically granted non-view admin.*
  permissions: existing grants are revoked by migration and the grant lookup
  is restricted to "%.view". Rank guards use the dynamic super-admin check.
- Alerting a user is permission-checked and audited like the other tools.
- Material mutations (giveCredits/giveDuckets/giveDiamonds, the admin user
  actions route, bulk user actions) are capped and rank-guarded, and bulk
  ids are bounded.
- updateRoom / updateRoomItem write through a field allowlist, and items
  may only be edited through their own room.
- Classnames reaching the filesystem are validated before use so a crafted
  value cannot escape the asset directories.
- The word filter now also covers offline mails, guild forum threads and
  replies, and user mottos.
- Media uploads are validated by magic bytes, /api/media requires the page
  edit permission, APP_URL must be configured once mail is enabled, and the
  diagnostics error route checks the fetch site header.

Admin tooling
- Secret settings render masked and cannot be overwritten with a blank or
  an arbitrary raw key; radio credentials are new password inputs.
- Commandocentrum balance changes are audited.
- Admin list pagination reads the caller's per-page instead of the max, and
  the log exporter caps offset and search length.

Performance
- Catalog translations are cached per module, with a cheap revision hash;
  the public online count uses a stale window instead of hammering the DB.
- The cache warmup now primes the payload the home route actually reads.
- TopHeader batches its queries into one round trip, and LCP avatars load
  eagerly.
- motion/react and sonner are no longer part of the root layout; the nav
  dropdown and mobile nav panels are lazy client chunks. Anonymous visitors
  again get the navigation chrome, and public pages get an edge cacheable
  response.

Accessibility
- Nested <main> elements in phase pages became <section>; the page entrance
  and route progress animations are pure CSS that respect reduced motion.

src/app/admin/radio/settings/page.tsx

@@ -7,7 +7,7 @@ import { StatusCard } from "@/components/admin/dashboard";
 import { Button } from "@/components/ui/button";
 import { db, WebsiteSetting } from "@/lib/db";
 
-type Field = { key: string; comment: string };
+type Field = { key: string; comment: string; secret?: boolean };
 type Group = { title: string; fields: Field[] };
 
 const GROUPS: Group[] = [
@@ -19,7 +19,11 @@ const GROUPS: Group[] = [
 			{ key: "radio_stream_backup_url", comment: "Backup stream URL" },
 			{ key: "radio_azurecast_base_url", comment: "AzureCast base URL" },
 			{ key: "radio_azurecast_station_id", comment: "AzureCast station ID" },
-			{ key: "radio_azurecast_api_key", comment: "AzureCast API key" },
+			{
+				key: "radio_azurecast_api_key",
+				comment: "AzureCast API key",
+				secret: true,
+			},
 			{ key: "radio_azurecast_port", comment: "AzureCast stream port" },
 			{
 				key: "radio_azurecast_protocol",
@@ -41,9 +45,14 @@ const GROUPS: Group[] = [
 			{
 				key: "radio_sambroadcaster_password",
 				comment: "Sambroadcaster password",
+				secret: true,
 			},
 			{ key: "radio_virtual_dj_url", comment: "Virtual DJ URL" },
-			{ key: "radio_virtual_dj_password", comment: "Virtual DJ password" },
+			{
+				key: "radio_virtual_dj_password",
+				comment: "Virtual DJ password",
+				secret: true,
+			},
 			{ key: "radio_djs_api_url", comment: "DJs API URL" },
 		],
 	},
@@ -331,7 +340,11 @@ const GROUPS: Group[] = [
 	{
 		title: "Discord webhook & custom code",
 		fields: [
-			{ key: "radio_discord_webhook_url", comment: "Discord webhook URL" },
+			{
+				key: "radio_discord_webhook_url",
+				comment: "Discord webhook URL",
+				secret: true,
+			},
 			{
 				key: "radio_discord_enabled",
 				comment: "Enable Discord notifications (0=no, 1=yes)",
@@ -467,7 +480,15 @@ export default async function AdminRadioSettingsPage() {
 									<input
 										id={`f_${field.key}`}
 										name={field.key}
-										defaultValue={values.get(field.key) ?? ""}
+										// Credentials are masked and blank means "keep".
+										type={field.secret ? "password" : "text"}
+										autoComplete="off"
+										placeholder={
+											field.secret ? "Leave blank to keep" : undefined
+										}
+										defaultValue={
+											field.secret ? "" : (values.get(field.key) ?? "")
+										}
 										style={{ width: "100%" }}
 									/>
 									{field.comment ? (