feat: shop buy, forum replies, tickets, messages, sessions, and UX hardening

Complete remaining product gaps: credit-based shop purchases, guild thread replies, help ticket detail/reply/close, offline message compose, sign-out-everywhere via JWT version, ads delete confirm, soft-fail feedback, rate limits, loading states, and single auth() in site layout.

Co-authored-by: Cursor <[email protected]>

prisma/migrations/0017_website_jwt_version.sql

@@ -0,0 +1,4 @@
+-- CMS JWT invalidation counter on users (stateless NextAuth sessions).
+-- Idempotent (MariaDB).
+ALTER TABLE users
+  ADD COLUMN IF NOT EXISTS website_jwt_version INT NOT NULL DEFAULT 0;

prisma/schema.prisma

@@ -64,6 +64,8 @@ model User {
   twoFactorSecret        String?   @map("two_factor_secret") @db.Text
   twoFactorRecoveryCodes String?   @map("two_factor_recovery_codes") @db.Text
   twoFactorConfirmedAt   DateTime? @map("two_factor_confirmed_at") @db.Timestamp(0)
+  // Bumped to invalidate all CMS JWT sessions ("sign out everywhere").
+  websiteJwtVersion      Int       @default(0) @map("website_jwt_version")
 
   createdTickets  WebsiteTicket[]        @relation("ticketCreator")
   assignedTickets WebsiteTicket[]        @relation("ticketAssignee")