Production hardening: error pages, rate limiting, metadata

- Custom not-found (404) + error / global-error boundaries, styled with
  the public design system; raw errors logged, never shown to users.
- In-process rate limiter (src/lib/rate-limit.ts) wired into the abuse-
  prone flows: login (10/5min/IP), register (5/10min/IP), password-reset
  request (3/15min/IP), keyed by the proxy-forwarded client IP.
- SEO/metadata: root generateMetadata sets a `%s · {hotel}` title
  template from the live hotel_name; dynamic generateMetadata on
  news/[slug] (article title + excerpt) and u/[username] (name + motto);
  static titles on 12 primary public pages.
- env.ts: added the vars introduced since (PASSWORD_HASH, OPENAI_API_KEY,
  DISCORD_WEBHOOK_URL, ALERT_EMAIL, PAYPAL_*) so env stays authoritative.

Verified on the prod server: /missing → 404 card, news title renders
"News · Habbo". tsc 0, vitest 49/49, next build 0.

src/env.ts

@@ -40,6 +40,17 @@ const schema = z.object({
     .string()
     .optional()
     .transform((v) => v === "true" || v === "1"),
+  // Hashing driver for NEW passwords: bcrypt (default, fits varchar(64)) | argon2id.
+  PASSWORD_HASH: z.enum(["bcrypt", "argon2id"]).optional(),
+  // Optional AI content moderation (comments / guestbook).
+  OPENAI_API_KEY: z.string().optional(),
+  // Optional alerting (jobs worker / alert service).
+  DISCORD_WEBHOOK_URL: z.string().url().optional(),
+  ALERT_EMAIL: z.string().optional(),
+  // Optional PayPal top-up.
+  PAYPAL_CLIENT_ID: z.string().optional(),
+  PAYPAL_SECRET: z.string().optional(),
+  PAYPAL_API: z.string().url().optional(),
 });
 
 type Env = z.infer<typeof schema>;