feat: harden atoms-nexst against review findings (37 items)

Second review pass covering security, performance, admin tooling and the
public/room flows. All HIGH and MEDIUM findings from the audit are resolved;
nothing in this commit changes the visible feature set.

Authentication & session security
- CSP is now set on the request headers in the proxy, which is what Next.js
  uses to derive the render nonce, so the nonce is effective.
- 2FA: an already-enabled user cannot re-enroll, the setup endpoint is
  rate-limited per account, and confirmed codes are persisted so the second
  secret no longer silently never applies.
- Password reset revokes the ticket, authTicket and all personal access
  tokens, and bumps the token version so existing sessions die. The same
  revocation is now wired into the staff-side password reset.
- /reset and /verify return a stable error code instead of raw text; the
  mail lookups are ordered by id so duplicates cannot vary between runs.
- Resending the verification mail gets a per-address cooldown on top of the
  per-user limit.
- Issue API tokens with the narrower radio/ticket ability set instead of "*".

Authorization & input handling
- Mid-rank staff can no longer keep dynamically granted non-view admin.*
  permissions: existing grants are revoked by migration and the grant lookup
  is restricted to "%.view". Rank guards use the dynamic super-admin check.
- Alerting a user is permission-checked and audited like the other tools.
- Material mutations (giveCredits/giveDuckets/giveDiamonds, the admin user
  actions route, bulk user actions) are capped and rank-guarded, and bulk
  ids are bounded.
- updateRoom / updateRoomItem write through a field allowlist, and items
  may only be edited through their own room.
- Classnames reaching the filesystem are validated before use so a crafted
  value cannot escape the asset directories.
- The word filter now also covers offline mails, guild forum threads and
  replies, and user mottos.
- Media uploads are validated by magic bytes, /api/media requires the page
  edit permission, APP_URL must be configured once mail is enabled, and the
  diagnostics error route checks the fetch site header.

Admin tooling
- Secret settings render masked and cannot be overwritten with a blank or
  an arbitrary raw key; radio credentials are new password inputs.
- Commandocentrum balance changes are audited.
- Admin list pagination reads the caller's per-page instead of the max, and
  the log exporter caps offset and search length.

Performance
- Catalog translations are cached per module, with a cheap revision hash;
  the public online count uses a stale window instead of hammering the DB.
- The cache warmup now primes the payload the home route actually reads.
- TopHeader batches its queries into one round trip, and LCP avatars load
  eagerly.
- motion/react and sonner are no longer part of the root layout; the nav
  dropdown and mobile nav panels are lazy client chunks. Anonymous visitors
  again get the navigation chrome, and public pages get an edge cacheable
  response.

Accessibility
- Nested <main> elements in phase pages became <section>; the page entrance
  and route progress animations are pure CSS that respect reduced motion.

src/proxy.ts

@@ -5,6 +5,7 @@ import { buildContentSecurityPolicy, createCspNonce } from "@/lib/csp";
 import { ddosReject, enforceDdosRateLimit } from "@/lib/ddos-guard";
 import {
 	isCacheableAssetPath,
+	isEdgeCacheablePublicPath,
 	shouldRedirectAdminRequest,
 } from "@/lib/proxy-access";
 
@@ -53,6 +54,11 @@ export const proxy = async (req: import("next/server").NextRequest) => {
 	const headers = new Headers(req.headers);
 	headers.set("x-pathname", pathname);
 	headers.set("x-nonce", nonce);
+	// Next derives its render nonce from the *request* `content-security-policy`
+	// header, not from `x-nonce`, so the policy has to travel on the request as
+	// well — otherwise every inline bootstrap/flight script Next emits ships
+	// without a nonce and is blocked by the very CSP we are building here.
+	headers.set("Content-Security-Policy", csp);
 
 	// A client may supply this legacy derived header; no consumer should trust it.
 	headers.delete("x-real-client-ip");
@@ -65,7 +71,23 @@ export const proxy = async (req: import("next/server").NextRequest) => {
 	// document would reference chunk URLs that no longer exist after a rebuild.
 	// Rendered avatars and uploaded media are immutable per key and already
 	// carry their own long-lived Cache-Control, so they keep it here.
-	if (!isCacheableAssetPath(pathname)) {
+	if (isCacheableAssetPath(pathname)) {
+		// Keep the asset headers as-is.
+	} else if (
+		isEdgeCacheablePublicPath(pathname) &&
+		!req.cookies.get("authjs.session-token") &&
+		!req.cookies.get("__Secure-authjs.session-token") &&
+		!req.nextUrl.searchParams.has("from")
+	) {
+		// Anonymous, low-variance public pages get a short shared cache with
+		// stale-while-revalidate, so a burst of visitors triggers one render
+		// instead of one per visitor. Anything session-dependent still falls
+		// through to the private header below.
+		response.headers.set(
+			"Cache-Control",
+			"public, max-age=0, s-maxage=30, stale-while-revalidate=300",
+		);
+	} else {
 		response.headers.set(
 			"Cache-Control",
 			"private, no-cache, no-store, max-age=0, must-revalidate",