Add dark mode, i18n, messenger/moderation/verify, admin CRUD parity

Web-tier features completing the AtomCMS→Next.js conversion (slice 2):

UI/UX:
- Dark mode: html.dark CSS-var overrides + ThemeSwitcher (localStorage,
  no-flash boot script) wired into the nav.
- i18n (next-intl, cookie-based / no URL routing): en + it catalogs,
  request.ts, provider in root layout, LanguageSwitcher; shell (nav,
  header, footer) fully translated. URLs + access-guard unchanged.
- globals.css: --muted/--border aliases used across admin pages.

User features:
- /messages: offline messages + friend-request accept (server action
  re-reads session, two directional rows, idempotent).
- Email verification: signed-token /verify route + sendVerification wired
  into register (best-effort, never blocks signup).
- Article reactions: toggle UI on news/[slug] + server action.
- Content moderation service (website_wordfilter + optional OpenAI
  moderations, fail-open) wired into article comments + guestbook.

Admin CRUD parity (Filament replacement):
- /admin/shop (+ new/[id]) packages CRUD + read-only orders.
- /admin/transactions read-only PayPal log.
- /admin/permissions, /admin/tags, /admin/ads (+ new/[id]),
  /admin/help-questions (+ new/[id]), /admin/radio/history,
  /admin/users/[id]/edit. All gated by requireStaff + logStaffActivity.

Verified: tsc 0, vitest 48/48, next build 0 (all routes incl. new
admin CRUD + /messages + /verify).

src/actions/messenger.ts

@@ -0,0 +1,75 @@
+"use server";
+
+import { revalidatePath } from "next/cache";
+import { auth } from "@/lib/auth";
+import { prisma } from "@/lib/prisma";
+
+/**
+ * Accept a pending friend request as the SIGNED-IN user.
+ *
+ * The ACCEPTER is re-read from the session via auth() and is never trusted from
+ * the submitted FormData. Only the request id comes from the form, and the
+ * request is only honoured when its target (user_to_id) is the session user —
+ * so a crafted form cannot accept a request addressed to someone else.
+ *
+ * Arcturus/AtomCMS stores friendships as TWO directional rows in
+ * messenger_friendships (one user_one_id→user_two_id, one the reverse). We
+ * create both inside a transaction and delete the originating request so it no
+ * longer shows as pending in the in-game messenger or here.
+ */
+export async function acceptFriend(formData: FormData): Promise<void> {
+  const session = await auth();
+  const meId = Number(session?.user?.id);
+  if (!Number.isInteger(meId) || meId <= 0) return;
+
+  const requestId = Number(formData.get("requestId"));
+  if (!Number.isInteger(requestId) || requestId <= 0) return;
+
+  try {
+    // The request must exist AND be addressed to the session user.
+    const request = await prisma.messengerFriendrequests.findUnique({
+      where: { id: requestId },
+      select: { id: true, userFromId: true, userToId: true },
+    });
+    if (!request || request.userToId !== meId) return;
+
+    const friendId = request.userFromId;
+    if (!Number.isInteger(friendId) || friendId <= 0 || friendId === meId) {
+      // Malformed/self request — just clear it.
+      await prisma.messengerFriendrequests.delete({ where: { id: requestId } });
+      return;
+    }
+
+    const friendsSince = Math.floor(Date.now() / 1000);
+
+    await prisma.$transaction(async (tx) => {
+      // Don't double-insert if a friendship already exists in either direction.
+      const existing = await tx.messengerFriendships.findFirst({
+        where: {
+          OR: [
+            { userOneId: meId, userTwoId: friendId },
+            { userOneId: friendId, userTwoId: meId },
+          ],
+        },
+        select: { id: true },
+      });
+
+      if (!existing) {
+        await tx.messengerFriendships.createMany({
+          data: [
+            { userOneId: meId, userTwoId: friendId, friendsSince },
+            { userOneId: friendId, userTwoId: meId, friendsSince },
+          ],
+        });
+      }
+
+      await tx.messengerFriendrequests.delete({ where: { id: requestId } });
+    });
+  } catch {
+    // DB unavailable — fail soft; nothing to persist.
+    return;
+  }
+
+  revalidatePath("/messages");
+  revalidatePath("/friends");
+}