Add dark mode, i18n, messenger/moderation/verify, admin CRUD parity

Web-tier features completing the AtomCMS→Next.js conversion (slice 2):

UI/UX:
- Dark mode: html.dark CSS-var overrides + ThemeSwitcher (localStorage,
  no-flash boot script) wired into the nav.
- i18n (next-intl, cookie-based / no URL routing): en + it catalogs,
  request.ts, provider in root layout, LanguageSwitcher; shell (nav,
  header, footer) fully translated. URLs + access-guard unchanged.
- globals.css: --muted/--border aliases used across admin pages.

User features:
- /messages: offline messages + friend-request accept (server action
  re-reads session, two directional rows, idempotent).
- Email verification: signed-token /verify route + sendVerification wired
  into register (best-effort, never blocks signup).
- Article reactions: toggle UI on news/[slug] + server action.
- Content moderation service (website_wordfilter + optional OpenAI
  moderations, fail-open) wired into article comments + guestbook.

Admin CRUD parity (Filament replacement):
- /admin/shop (+ new/[id]) packages CRUD + read-only orders.
- /admin/transactions read-only PayPal log.
- /admin/permissions, /admin/tags, /admin/ads (+ new/[id]),
  /admin/help-questions (+ new/[id]), /admin/radio/history,
  /admin/users/[id]/edit. All gated by requireStaff + logStaffActivity.

Verified: tsc 0, vitest 48/48, next build 0 (all routes incl. new
admin CRUD + /messages + /verify).

src/actions/article-reactions.ts

@@ -0,0 +1,94 @@
+"use server";
+
+import { revalidatePath } from "next/cache";
+import { auth } from "@/lib/auth";
+import { prisma } from "@/lib/prisma";
+
+// The reaction set the UI offers. The action rejects anything outside this list
+// so the website_article_reactions.reaction VARCHAR(50) only ever holds known
+// values. Keep this in sync with REACTIONS in src/app/news/[slug]/page.tsx.
+const ALLOWED_REACTIONS = new Set(["like", "love", "wow"]);
+
+/**
+ * Toggle the SIGNED-IN user's reaction on a news article.
+ *
+ * The voter id is read from the session (re-fetched via auth()), never from the
+ * submitted FormData, so a crafted form cannot vote as another account. A user
+ * has at most one ACTIVE reaction per article:
+ *   - clicking the reaction they already have active -> deactivates it (un-vote)
+ *   - clicking a different reaction -> that reaction becomes active and any other
+ *     reaction rows for this user/article are deactivated
+ *   - first-ever reaction of a type -> a new active row is created
+ *
+ * Rows are toggled (active flag) rather than deleted so a user's history of
+ * reaction types is preserved. website_article_reactions has no composite
+ * unique key, so we resolve the existing row with findFirst rather than upsert.
+ */
+export async function toggleReaction(formData: FormData): Promise<void> {
+  const session = await auth();
+  if (!session?.user?.id) return;
+
+  const userId = Number(session.user.id);
+  if (!Number.isFinite(userId)) return;
+
+  const reaction = String(formData.get("reaction") ?? "").trim().toLowerCase();
+  if (!ALLOWED_REACTIONS.has(reaction)) return;
+
+  const articleIdRaw = String(formData.get("articleId") ?? "").trim();
+  if (!/^\d+$/.test(articleIdRaw)) return;
+
+  let articleId: bigint;
+  try {
+    articleId = BigInt(articleIdRaw);
+  } catch {
+    return;
+  }
+
+  let slug: string | null = null;
+  try {
+    // Confirm the article exists (and grab its slug for revalidation).
+    const article = await prisma.websiteArticles.findUnique({
+      where: { id: articleId },
+      select: { slug: true },
+    });
+    if (!article) return;
+    slug = article.slug;
+
+    // The user's current row for THIS reaction on THIS article, if any.
+    const existing = await prisma.websiteArticleReactions.findFirst({
+      where: { userId, articleId, reaction },
+      select: { id: true, active: true },
+    });
+
+    if (existing?.active) {
+      // Already reacting with this exact reaction -> un-vote (deactivate it).
+      await prisma.websiteArticleReactions.update({
+        where: { id: existing.id },
+        data: { active: false },
+      });
+    } else {
+      // Switching to (or first-time picking) this reaction: clear any other
+      // active reaction by this user on this article, then activate this one.
+      await prisma.websiteArticleReactions.updateMany({
+        where: { userId, articleId, active: true },
+        data: { active: false },
+      });
+
+      if (existing) {
+        await prisma.websiteArticleReactions.update({
+          where: { id: existing.id },
+          data: { active: true },
+        });
+      } else {
+        await prisma.websiteArticleReactions.create({
+          data: { userId, articleId, reaction, active: true },
+        });
+      }
+    }
+  } catch {
+    // DB unavailable — fail soft; nothing to persist.
+    return;
+  }
+
+  if (slug) revalidatePath(`/news/${slug}`);
+}