Production hardening: error pages, rate limiting, metadata

- Custom not-found (404) + error / global-error boundaries, styled with
  the public design system; raw errors logged, never shown to users.
- In-process rate limiter (src/lib/rate-limit.ts) wired into the abuse-
  prone flows: login (10/5min/IP), register (5/10min/IP), password-reset
  request (3/15min/IP), keyed by the proxy-forwarded client IP.
- SEO/metadata: root generateMetadata sets a `%s · {hotel}` title
  template from the live hotel_name; dynamic generateMetadata on
  news/[slug] (article title + excerpt) and u/[username] (name + motto);
  static titles on 12 primary public pages.
- env.ts: added the vars introduced since (PASSWORD_HASH, OPENAI_API_KEY,
  DISCORD_WEBHOOK_URL, ALERT_EMAIL, PAYPAL_*) so env stays authoritative.

Verified on the prod server: /missing → 404 card, news title renders
"News · Habbo". tsc 0, vitest 49/49, next build 0.

src/app/layout.tsx

@@ -9,6 +9,7 @@ import { SiteHeader } from "@/components/site-header";
 import { ThemeVars } from "@/components/theme-vars";
 import { TopHeader } from "@/components/top-header";
 import { enforceSiteAccess } from "@/lib/access-guard";
+import { siteSettings } from "@/lib/services/site-settings";
 import "./globals.css";
 
 const nunito = Nunito({
@@ -18,10 +19,13 @@ const nunito = Nunito({
   variable: "--font-nunito",
 });
 
-export const metadata: Metadata = {
-  title: "AtomCMS",
-  description: "AtomCMS — retro hotel CMS (Next.js conversion)",
-};
+export async function generateMetadata(): Promise<Metadata> {
+  const hotel = (await siteSettings.get("hotel_name", "Atom")) ?? "Atom";
+  return {
+    title: { default: hotel, template: `%s · ${hotel}` },
+    description: `${hotel} — a Habbo retro hotel. Hang out, collect furni and meet friends.`,
+  };
+}
 
 export default async function RootLayout({ children }: { children: ReactNode }) {
   await enforceSiteAccess();