Production hardening: error pages, rate limiting, metadata

- Custom not-found (404) + error / global-error boundaries, styled with
  the public design system; raw errors logged, never shown to users.
- In-process rate limiter (src/lib/rate-limit.ts) wired into the abuse-
  prone flows: login (10/5min/IP), register (5/10min/IP), password-reset
  request (3/15min/IP), keyed by the proxy-forwarded client IP.
- SEO/metadata: root generateMetadata sets a `%s · {hotel}` title
  template from the live hotel_name; dynamic generateMetadata on
  news/[slug] (article title + excerpt) and u/[username] (name + motto);
  static titles on 12 primary public pages.
- env.ts: added the vars introduced since (PASSWORD_HASH, OPENAI_API_KEY,
  DISCORD_WEBHOOK_URL, ALERT_EMAIL, PAYPAL_*) so env stays authoritative.

Verified on the prod server: /missing → 404 card, news title renders
"News · Habbo". tsc 0, vitest 49/49, next build 0.

src/actions/password-reset.ts

@@ -3,6 +3,7 @@
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import { redirect } from "next/navigation";
 import { hashPassword } from "@/lib/auth/password";
+import { clientIp, rateLimit } from "@/lib/rate-limit";
 import { prisma } from "@/lib/prisma";
 import { sendMail } from "@/lib/services/email";
 import { env } from "@/env";
@@ -16,8 +17,11 @@ function sha256(s: string): string {
 export async function requestReset(formData: FormData): Promise<void> {
   const email = String(formData.get("email") ?? "").trim().toLowerCase();
 
+  // Throttle reset requests per IP (3 per 15 min) to curb email-bomb abuse.
+  const allowed = rateLimit(`reset:${await clientIp()}`, 3, 15 * 60_000).ok;
+
   // Always respond the same way so we don't reveal which emails exist.
-  if (/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) {
+  if (allowed && /^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) {
     try {
       const user = await prisma.user.findFirst({ where: { mail: email }, select: { id: true } });
       if (user) {

src/actions/register.ts

@@ -5,6 +5,7 @@ import { redirect } from "next/navigation";
 import { sendVerification } from "@/actions/email-verify";
 import { hashPassword } from "@/lib/auth/password";
 import { prisma } from "@/lib/prisma";
+import { clientIp, rateLimit } from "@/lib/rate-limit";
 
 const USERNAME_RE = /^[A-Za-z0-9_\-=?!@:.,]{3,25}$/;
 const EMAIL_RE = /^[^@\s]+@[^@\s]+\.[^@\s]+$/;
@@ -21,6 +22,12 @@ export async function register(formData: FormData): Promise<void> {
   else if (password.length < 6) error = "Password must be at least 6 characters";
   else if (!EMAIL_RE.test(mail)) error = "Enter a valid email address";
 
+  // Throttle sign-ups per IP (5 per 10 minutes) to curb account spam.
+  if (!error) {
+    const limit = rateLimit(`register:${await clientIp()}`, 5, 10 * 60_000);
+    if (!limit.ok) error = "Too many sign-up attempts. Please wait a few minutes and try again.";
+  }
+
   // Uniqueness check (kept out of the success path's try so NEXT_REDIRECT propagates).
   if (!error) {
     try {