Add public REST API, anti-abuse protections, radio/GitHub cron jobs

Phase A — Public REST API (was the biggest gap). 20 JSON endpoints under
/api mirroring AtomCMS: users/[username], online(+/count), me, articles
(+/[slug]), photos, home, staff, teams, leaderboard, shop(+/categories),
values(+/categories), settings, radio/{config,now-playing,listeners,
shouts}. Shared src/lib/api.ts (apiJson — BigInt-safe + CORS, pagination).
Read-only, fail-soft, and field-safe (never exposes password/auth_ticket/
2FA secrets/mail).

Phase B — Anti-abuse on registration: CAPTCHA (Cloudflare Turnstile /
Google reCAPTCHA, settings-driven, widget rendered on the register page),
VPN/proxy detection (proxycheck.io / IPQualityScore via /admin/vpn
settings), and max-accounts-per-IP. All fail-open when unconfigured.
src/lib/services/{captcha,ip-lookup}.ts.

Phase C — jobs-worker cron suite: radio-record-songs (30s, logs track
changes to radio_song_plays), radio-auto-dj (rotates radio_auto_dj_playlist
when no live DJ), github-update-check (hourly, sets update_available).
Shared src/lib/services/radio.ts (now-playing/listeners parsing).

Verified live (prod, amx_test): /api/* return real JSON (leaderboard 6
users, settings carry no secrets, user endpoint hides password). tsc 0,
vitest 49/49, next build 0 (20 new API routes).

src/app/api/values/categories/route.ts

@@ -0,0 +1,26 @@
+// Public REST: rare value categories (website_rare_value_categories).
+// AtomCMS JSON API parity — read-only list ordered by priority then name,
+// matching the admin /admin/rare-values query.
+import { apiJson } from "@/lib/api";
+import { prisma } from "@/lib/prisma";
+
+export const dynamic = "force-dynamic";
+
+export async function GET(_req: Request) {
+  try {
+    const data = await prisma.websiteRareValueCategories.findMany({
+      orderBy: [{ priority: "asc" }, { name: "asc" }],
+      select: {
+        id: true,
+        name: true,
+        badge: true,
+        priority: true,
+      },
+    });
+
+    return apiJson({ data });
+  } catch {
+    // DB unreachable — never 500; return empty data.
+    return apiJson({ data: [] }, { status: 200 });
+  }
+}

src/app/api/values/route.ts

@@ -0,0 +1,56 @@
+// Public REST: rare furni trade values (website_rare_values).
+// AtomCMS JSON API parity — read-only catalog of rares with their credit /
+// currency values. Supports ?category=<id> filter; paginated, ordered by name.
+import { apiJson, pagination } from "@/lib/api";
+import { prisma } from "@/lib/prisma";
+
+export const dynamic = "force-dynamic";
+
+export async function GET(req: Request) {
+  const sp = new URL(req.url).searchParams;
+  const { page, perPage, skip, take } = pagination(sp);
+
+  // Optional ?category=<id> filter (category_id is a BigInt).
+  const categoryRaw = sp.get("category");
+  let where: { categoryId?: bigint } = {};
+  if (categoryRaw && /^\d+$/.test(categoryRaw)) {
+    try {
+      where = { categoryId: BigInt(categoryRaw) };
+    } catch {
+      where = {};
+    }
+  }
+
+  try {
+    const [total, data] = await Promise.all([
+      prisma.websiteRareValues.count({ where }),
+      prisma.websiteRareValues.findMany({
+        where,
+        orderBy: { name: "asc" },
+        skip,
+        take,
+        select: {
+          id: true,
+          categoryId: true,
+          itemId: true,
+          name: true,
+          creditValue: true,
+          currencyValue: true,
+          currencyType: true,
+          furnitureIcon: true,
+        },
+      }),
+    ]);
+
+    return apiJson({
+      data,
+      meta: { page, perPage, total, lastPage: Math.max(1, Math.ceil(total / perPage)) },
+    });
+  } catch {
+    // DB unreachable — never 500; return an empty, well-formed payload.
+    return apiJson(
+      { data: [], meta: { page, perPage, total: 0, lastPage: 1 } },
+      { status: 200 },
+    );
+  }
+}