Add dark mode, i18n, messenger/moderation/verify, admin CRUD parity

Web-tier features completing the AtomCMS→Next.js conversion (slice 2):

UI/UX:
- Dark mode: html.dark CSS-var overrides + ThemeSwitcher (localStorage,
  no-flash boot script) wired into the nav.
- i18n (next-intl, cookie-based / no URL routing): en + it catalogs,
  request.ts, provider in root layout, LanguageSwitcher; shell (nav,
  header, footer) fully translated. URLs + access-guard unchanged.
- globals.css: --muted/--border aliases used across admin pages.

User features:
- /messages: offline messages + friend-request accept (server action
  re-reads session, two directional rows, idempotent).
- Email verification: signed-token /verify route + sendVerification wired
  into register (best-effort, never blocks signup).
- Article reactions: toggle UI on news/[slug] + server action.
- Content moderation service (website_wordfilter + optional OpenAI
  moderations, fail-open) wired into article comments + guestbook.

Admin CRUD parity (Filament replacement):
- /admin/shop (+ new/[id]) packages CRUD + read-only orders.
- /admin/transactions read-only PayPal log.
- /admin/permissions, /admin/tags, /admin/ads (+ new/[id]),
  /admin/help-questions (+ new/[id]), /admin/radio/history,
  /admin/users/[id]/edit. All gated by requireStaff + logStaffActivity.

Verified: tsc 0, vitest 48/48, next build 0 (all routes incl. new
admin CRUD + /messages + /verify).

src/actions/email-verify.ts

@@ -0,0 +1,88 @@
+"use server";
+
+import { createHash, timingSafeEqual } from "node:crypto";
+import { env } from "@/env";
+import { sendMail } from "@/lib/services/email";
+import { siteSettings } from "@/lib/services/site-settings";
+
+// Stateless email verification, AtomCMS-faithful but DB-table-free.
+//
+// Instead of persisting a row (password_resets style), the token is a keyed
+// digest of the email address: sha256(email + APP_KEY). Because APP_KEY is a
+// server-only secret, an attacker who only knows the email cannot forge a
+// matching token, and /verify can recompute + compare it without any storage.
+// The token is therefore deterministic per (email, secret) pair and stays valid
+// until the account's mail_verified flips to '1' (after which /verify no-ops).
+
+/** Secret mixed into the digest. Falls back to AUTH_SECRET, then a constant. */
+function verifySecret(): string {
+  return env.APP_KEY || env.AUTH_SECRET || "atom-cms-verify";
+}
+
+/** Compute the verification token for an email (lowercased + trimmed). */
+export async function verificationToken(email: string): Promise<string> {
+  const normalised = email.trim().toLowerCase();
+  return createHash("sha256").update(`${normalised}|${verifySecret()}`).digest("hex");
+}
+
+/**
+ * Constant-time check that `token` matches the expected digest for `email`.
+ * Returns false on any length/format mismatch rather than throwing.
+ */
+export async function isValidVerificationToken(
+  email: string,
+  token: string,
+): Promise<boolean> {
+  if (!email || !token || !/^[a-f0-9]{64}$/i.test(token)) return false;
+  const expected = await verificationToken(email);
+  const a = Buffer.from(expected, "utf8");
+  const b = Buffer.from(token.toLowerCase(), "utf8");
+  if (a.length !== b.length) return false;
+  return timingSafeEqual(a, b);
+}
+
+/**
+ * Build the verification link + email and send it. No-ops gracefully when SMTP
+ * is unconfigured (sendMail returns false). `userId` is accepted for a faithful
+ * call signature, but the stateless token only needs the email.
+ */
+export async function sendVerification(userId: number, email: string): Promise<boolean> {
+  const normalised = email.trim().toLowerCase();
+  if (!normalised) return false;
+
+  const token = await verificationToken(normalised);
+  const base = env.APP_URL.replace(/\/+$/, "");
+  const link = `${base}/verify?token=${encodeURIComponent(token)}&email=${encodeURIComponent(
+    normalised,
+  )}`;
+
+  const hotelName = (await siteSettings.get("hotel_name", env.HOTEL_NAME)) ?? env.HOTEL_NAME;
+
+  const html = `
+    <div style="font-family:sans-serif;line-height:1.5;color:#0f172a">
+      <h2 style="margin:0 0 0.5rem">Verify your email</h2>
+      <p>Welcome to ${escapeHtml(hotelName)}! Confirm this email address to finish setting up your account.</p>
+      <p style="margin:1.25rem 0">
+        <a href="${link}"
+           style="display:inline-block;padding:0.6rem 1.2rem;border-radius:8px;background:#eeb425;color:#1a1a2e;font-weight:700;text-decoration:none">
+          Verify email
+        </a>
+      </p>
+      <p style="color:#64748b;font-size:0.875rem">If the button doesn't work, paste this link into your browser:</p>
+      <p style="color:#64748b;font-size:0.875rem;word-break:break-all">${link}</p>
+    </div>
+  `.trim();
+
+  // `userId` referenced so a faithful caller signature isn't flagged unused.
+  void userId;
+
+  return sendMail(normalised, `Verify your email · ${hotelName}`, html);
+}
+
+function escapeHtml(s: string): string {
+  return s
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;");
+}