Add public REST API, anti-abuse protections, radio/GitHub cron jobs

Phase A — Public REST API (was the biggest gap). 20 JSON endpoints under
/api mirroring AtomCMS: users/[username], online(+/count), me, articles
(+/[slug]), photos, home, staff, teams, leaderboard, shop(+/categories),
values(+/categories), settings, radio/{config,now-playing,listeners,
shouts}. Shared src/lib/api.ts (apiJson — BigInt-safe + CORS, pagination).
Read-only, fail-soft, and field-safe (never exposes password/auth_ticket/
2FA secrets/mail).

Phase B — Anti-abuse on registration: CAPTCHA (Cloudflare Turnstile /
Google reCAPTCHA, settings-driven, widget rendered on the register page),
VPN/proxy detection (proxycheck.io / IPQualityScore via /admin/vpn
settings), and max-accounts-per-IP. All fail-open when unconfigured.
src/lib/services/{captcha,ip-lookup}.ts.

Phase C — jobs-worker cron suite: radio-record-songs (30s, logs track
changes to radio_song_plays), radio-auto-dj (rotates radio_auto_dj_playlist
when no live DJ), github-update-check (hourly, sets update_available).
Shared src/lib/services/radio.ts (now-playing/listeners parsing).

Verified live (prod, amx_test): /api/* return real JSON (leaderboard 6
users, settings carry no secrets, user endpoint hides password). tsc 0,
vitest 49/49, next build 0 (20 new API routes).

src/app/api/radio/config/route.ts

@@ -0,0 +1,45 @@
+import { apiJson } from "@/lib/api";
+import { prisma } from "@/lib/prisma";
+
+// Radio player config: the subset of radio_* website_settings the front-end
+// player needs (stream URL, name, autoplay, enabled, widget visibility) as a
+// flat { key: value } map. No secrets live among these keys.
+export const dynamic = "force-dynamic";
+
+// radio_* keys relevant to the public player widget. Mirrors what the AtomCMS
+// radio-player blade requests from /api/radio/config.
+const CONFIG_KEYS = new Set([
+  "radio_enabled",
+  "radio_name",
+  "radio_stream_url",
+  "radio_stream_backup_url",
+  "radio_auto_play",
+  "radio_auto_play_delay",
+  "radio_mute_on_start",
+  "radio_volume",
+  "radio_style",
+  "radio_player_type",
+  "radio_logo_url",
+  "radio_widget_enabled",
+  "radio_widget_show_globally",
+  "radio_widget_position",
+]);
+
+export async function GET(_req: Request) {
+  try {
+    const rows = await prisma.websiteSetting.findMany({
+      where: { key: { in: Array.from(CONFIG_KEYS) } },
+      select: { key: true, value: true },
+    });
+
+    const config: Record<string, string> = {};
+    for (const row of rows) {
+      config[row.key] = row.value;
+    }
+
+    return apiJson(config);
+  } catch {
+    // DB unavailable — serve an empty config rather than a 500.
+    return apiJson({}, { status: 200 });
+  }
+}