Add dark mode, i18n, messenger/moderation/verify, admin CRUD parity

Web-tier features completing the AtomCMS→Next.js conversion (slice 2):

UI/UX:
- Dark mode: html.dark CSS-var overrides + ThemeSwitcher (localStorage,
  no-flash boot script) wired into the nav.
- i18n (next-intl, cookie-based / no URL routing): en + it catalogs,
  request.ts, provider in root layout, LanguageSwitcher; shell (nav,
  header, footer) fully translated. URLs + access-guard unchanged.
- globals.css: --muted/--border aliases used across admin pages.

User features:
- /messages: offline messages + friend-request accept (server action
  re-reads session, two directional rows, idempotent).
- Email verification: signed-token /verify route + sendVerification wired
  into register (best-effort, never blocks signup).
- Article reactions: toggle UI on news/[slug] + server action.
- Content moderation service (website_wordfilter + optional OpenAI
  moderations, fail-open) wired into article comments + guestbook.

Admin CRUD parity (Filament replacement):
- /admin/shop (+ new/[id]) packages CRUD + read-only orders.
- /admin/transactions read-only PayPal log.
- /admin/permissions, /admin/tags, /admin/ads (+ new/[id]),
  /admin/help-questions (+ new/[id]), /admin/radio/history,
  /admin/users/[id]/edit. All gated by requireStaff + logStaffActivity.

Verified: tsc 0, vitest 48/48, next build 0 (all routes incl. new
admin CRUD + /messages + /verify).

src/actions/register.ts

@@ -2,6 +2,7 @@
 
 import { headers } from "next/headers";
 import { redirect } from "next/navigation";
+import { sendVerification } from "@/actions/email-verify";
 import { hashPassword } from "@/lib/auth/password";
 import { prisma } from "@/lib/prisma";
 
@@ -39,7 +40,7 @@ export async function register(formData: FormData): Promise<void> {
       h.get("x-forwarded-for")?.split(",")[0]?.trim() ?? h.get("x-real-ip") ?? "0.0.0.0";
     const now = Math.floor(Date.now() / 1000);
     try {
-      await prisma.user.create({
+      const created = await prisma.user.create({
         data: {
           username,
           password: await hashPassword(password),
@@ -49,7 +50,16 @@ export async function register(formData: FormData): Promise<void> {
           ipCurrent: ip,
           look: DEFAULT_LOOK,
         },
+        select: { id: true },
       });
+
+      // Fire the verification email. Best-effort: a mail/SMTP failure must not
+      // abort a successful registration, so swallow its errors here.
+      try {
+        await sendVerification(created.id, mail);
+      } catch {
+        // No-op: account is created; user can request a new link later.
+      }
     } catch {
       error = "Could not create the account (is the username unique?)";
     }