Add public REST API, anti-abuse protections, radio/GitHub cron jobs

Phase A — Public REST API (was the biggest gap). 20 JSON endpoints under
/api mirroring AtomCMS: users/[username], online(+/count), me, articles
(+/[slug]), photos, home, staff, teams, leaderboard, shop(+/categories),
values(+/categories), settings, radio/{config,now-playing,listeners,
shouts}. Shared src/lib/api.ts (apiJson — BigInt-safe + CORS, pagination).
Read-only, fail-soft, and field-safe (never exposes password/auth_ticket/
2FA secrets/mail).

Phase B — Anti-abuse on registration: CAPTCHA (Cloudflare Turnstile /
Google reCAPTCHA, settings-driven, widget rendered on the register page),
VPN/proxy detection (proxycheck.io / IPQualityScore via /admin/vpn
settings), and max-accounts-per-IP. All fail-open when unconfigured.
src/lib/services/{captcha,ip-lookup}.ts.

Phase C — jobs-worker cron suite: radio-record-songs (30s, logs track
changes to radio_song_plays), radio-auto-dj (rotates radio_auto_dj_playlist
when no live DJ), github-update-check (hourly, sets update_available).
Shared src/lib/services/radio.ts (now-playing/listeners parsing).

Verified live (prod, amx_test): /api/* return real JSON (leaderboard 6
users, settings carry no secrets, user endpoint hides password). tsc 0,
vitest 49/49, next build 0 (20 new API routes).

src/app/api/me/route.ts

@@ -0,0 +1,60 @@
+// Public REST API — the currently signed-in user.
+//
+// Reads the NextAuth session, then re-queries prisma.user by the session id to
+// return a safe field set (never password / auth_ticket / 2FA secrets / pincode
+// / mail). Returns { user: null } when unauthenticated or on DB failure.
+
+import { apiJson } from "@/lib/api";
+import { auth } from "@/lib/auth";
+import { prisma } from "@/lib/prisma";
+
+export const dynamic = "force-dynamic";
+
+export async function GET(_req: Request) {
+  const session = await auth();
+  const id = session?.user?.id ? Number(session.user.id) : null;
+  if (!id || Number.isNaN(id)) {
+    return apiJson({ user: null });
+  }
+
+  try {
+    const user = await prisma.user.findUnique({
+      where: { id },
+      select: {
+        id: true,
+        username: true,
+        look: true,
+        motto: true,
+        rank: true,
+        credits: true,
+        pixels: true,
+        points: true,
+        gender: true,
+        online: true,
+        accountCreated: true,
+      },
+    });
+
+    if (!user) {
+      return apiJson({ user: null });
+    }
+
+    return apiJson({
+      user: {
+        id: user.id,
+        username: user.username,
+        look: user.look,
+        motto: user.motto,
+        rank: user.rank,
+        credits: user.credits,
+        pixels: user.pixels,
+        points: user.points,
+        gender: user.gender,
+        online: user.online === "1",
+        accountCreated: user.accountCreated,
+      },
+    });
+  } catch {
+    return apiJson({ user: null });
+  }
+}