feat: harden atoms-nexst against review findings (37 items)

Second review pass covering security, performance, admin tooling and the
public/room flows. All HIGH and MEDIUM findings from the audit are resolved;
nothing in this commit changes the visible feature set.

Authentication & session security
- CSP is now set on the request headers in the proxy, which is what Next.js
  uses to derive the render nonce, so the nonce is effective.
- 2FA: an already-enabled user cannot re-enroll, the setup endpoint is
  rate-limited per account, and confirmed codes are persisted so the second
  secret no longer silently never applies.
- Password reset revokes the ticket, authTicket and all personal access
  tokens, and bumps the token version so existing sessions die. The same
  revocation is now wired into the staff-side password reset.
- /reset and /verify return a stable error code instead of raw text; the
  mail lookups are ordered by id so duplicates cannot vary between runs.
- Resending the verification mail gets a per-address cooldown on top of the
  per-user limit.
- Issue API tokens with the narrower radio/ticket ability set instead of "*".

Authorization & input handling
- Mid-rank staff can no longer keep dynamically granted non-view admin.*
  permissions: existing grants are revoked by migration and the grant lookup
  is restricted to "%.view". Rank guards use the dynamic super-admin check.
- Alerting a user is permission-checked and audited like the other tools.
- Material mutations (giveCredits/giveDuckets/giveDiamonds, the admin user
  actions route, bulk user actions) are capped and rank-guarded, and bulk
  ids are bounded.
- updateRoom / updateRoomItem write through a field allowlist, and items
  may only be edited through their own room.
- Classnames reaching the filesystem are validated before use so a crafted
  value cannot escape the asset directories.
- The word filter now also covers offline mails, guild forum threads and
  replies, and user mottos.
- Media uploads are validated by magic bytes, /api/media requires the page
  edit permission, APP_URL must be configured once mail is enabled, and the
  diagnostics error route checks the fetch site header.

Admin tooling
- Secret settings render masked and cannot be overwritten with a blank or
  an arbitrary raw key; radio credentials are new password inputs.
- Commandocentrum balance changes are audited.
- Admin list pagination reads the caller's per-page instead of the max, and
  the log exporter caps offset and search length.

Performance
- Catalog translations are cached per module, with a cheap revision hash;
  the public online count uses a stale window instead of hammering the DB.
- The cache warmup now primes the payload the home route actually reads.
- TopHeader batches its queries into one round trip, and LCP avatars load
  eagerly.
- motion/react and sonner are no longer part of the root layout; the nav
  dropdown and mobile nav panels are lazy client chunks. Anonymous visitors
  again get the navigation chrome, and public pages get an edge cacheable
  response.

Accessibility
- Nested <main> elements in phase pages became <section>; the page entrance
  and route progress animations are pure CSS that respect reduced motion.

src/app/api/leaderboard/route.ts

@@ -14,11 +14,29 @@ const CURRENCY_TYPE: Record<Exclude<LeaderboardType, "credits">, number> = {
 	duckets: 0,
 };
 
-type Row = { rank: number; username: string; look: string; value: number };
+type Row = {
+	rank: number;
+	userId: number;
+	username: string;
+	look: string;
+	value: number;
+};
+
+/** Hidden-wallet users must not be listed, exactly like on the page. */
+async function withoutHiddenWallets<T extends { userId: number }>(
+	rows: T[],
+): Promise<T[]> {
+	const { loadProfilePrivacyMap } = await import(
+		"@/lib/services/profile-privacy"
+	);
+	const privacy = await loadProfilePrivacyMap(rows.map((r) => r.userId));
+	return rows.filter((r) => privacy.get(r.userId)?.wallet !== false);
+}
 
 async function loadCreditsRows(): Promise<Row[]> {
 	const users = await db
 		.select({
+			userId: User.id,
 			username: User.username,
 			look: User.look,
 			credits: User.credits,
@@ -26,8 +44,9 @@ async function loadCreditsRows(): Promise<Row[]> {
 		.from(User)
 		.orderBy(desc(User.credits))
 		.limit(20);
-	return users.map((u, i) => ({
+	return (await withoutHiddenWallets(users)).map((u, i) => ({
 		rank: i + 1,
+		userId: u.userId,
 		username: u.username,
 		look: u.look,
 		value: u.credits,
@@ -55,15 +74,24 @@ async function loadCurrencyRows(type: number): Promise<Row[]> {
 				top.map((t) => t.userId),
 			),
 		);
-	const byId = new Map(users.map((u) => [u.id, u]));
+	const allowed = await withoutHiddenWallets(top);
+	const allowedIds = new Set(allowed.map((t) => t.userId));
+	const byId = new Map(
+		users.filter((u) => allowedIds.has(u.id)).map((u) => [u.id, u]),
+	);
 
-	return top
+	return allowed
 		.map((t) => {
 			const u = byId.get(t.userId);
 			if (!u) return null;
-			return { username: u.username, look: u.look, value: t.amount };
+			return {
+				userId: u.id,
+				username: u.username,
+				look: u.look,
+				value: t.amount,
+			};
 		})
-		.filter((r): r is Omit<Row, "rank"> => r !== null)
+		.filter((r) => r !== null)
 		.map((r, i) => ({ rank: i + 1, ...r }));
 }