Add public REST API, anti-abuse protections, radio/GitHub cron jobs

Phase A — Public REST API (was the biggest gap). 20 JSON endpoints under
/api mirroring AtomCMS: users/[username], online(+/count), me, articles
(+/[slug]), photos, home, staff, teams, leaderboard, shop(+/categories),
values(+/categories), settings, radio/{config,now-playing,listeners,
shouts}. Shared src/lib/api.ts (apiJson — BigInt-safe + CORS, pagination).
Read-only, fail-soft, and field-safe (never exposes password/auth_ticket/
2FA secrets/mail).

Phase B — Anti-abuse on registration: CAPTCHA (Cloudflare Turnstile /
Google reCAPTCHA, settings-driven, widget rendered on the register page),
VPN/proxy detection (proxycheck.io / IPQualityScore via /admin/vpn
settings), and max-accounts-per-IP. All fail-open when unconfigured.
src/lib/services/{captcha,ip-lookup}.ts.

Phase C — jobs-worker cron suite: radio-record-songs (30s, logs track
changes to radio_song_plays), radio-auto-dj (rotates radio_auto_dj_playlist
when no live DJ), github-update-check (hourly, sets update_available).
Shared src/lib/services/radio.ts (now-playing/listeners parsing).

Verified live (prod, amx_test): /api/* return real JSON (leaderboard 6
users, settings carry no secrets, user endpoint hides password). tsc 0,
vitest 49/49, next build 0 (20 new API routes).

src/lib/services/radio.ts

@@ -0,0 +1,79 @@
+import { siteSettings } from "@/lib/services/site-settings";
+
+/**
+ * Best-effort radio stream helpers, shared by the public API and the jobs
+ * worker. They poll the now-playing / listeners endpoints configured in
+ * website_settings (AzureCast / Icecast / Shoutcast all differ), parsing the
+ * common shapes. Everything fails soft (returns null) on error/missing config.
+ */
+export interface NowPlaying {
+  title: string;
+  artist: string | null;
+}
+
+async function fetchJson(url: string, ms = 4000): Promise<unknown> {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), ms);
+  try {
+    const res = await fetch(url, { signal: controller.signal, cache: "no-store" });
+    const text = await res.text();
+    try {
+      return JSON.parse(text);
+    } catch {
+      return text; // plain-text "Artist - Title" (Shoutcast/Icecast metadata)
+    }
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+function parseNowPlaying(d: unknown): NowPlaying | null {
+  if (!d) return null;
+  // AzureCast: { now_playing: { song: { title, artist } } }
+  const azure = (d as { now_playing?: { song?: { title?: string; artist?: string; text?: string } } })
+    .now_playing?.song;
+  if (azure?.title || azure?.text) {
+    return { title: azure.title ?? azure.text ?? "", artist: azure.artist ?? null };
+  }
+  // Generic JSON: { title, artist } or { songtitle }
+  const generic = d as { title?: string; artist?: string; songtitle?: string };
+  if (generic.title) return { title: generic.title, artist: generic.artist ?? null };
+  if (generic.songtitle) {
+    const [a, t] = generic.songtitle.split(" - ");
+    return t ? { title: t.trim(), artist: a.trim() } : { title: generic.songtitle, artist: null };
+  }
+  // Plain text "Artist - Title"
+  if (typeof d === "string" && d.trim()) {
+    const parts = d.split(" - ");
+    return parts.length > 1
+      ? { title: parts.slice(1).join(" - ").trim(), artist: parts[0].trim() }
+      : { title: d.trim(), artist: null };
+  }
+  return null;
+}
+
+export async function fetchNowPlaying(): Promise<NowPlaying | null> {
+  const url = (await siteSettings.get("radio_now_playing_api_url", "")) ?? "";
+  if (!url) return null;
+  return parseNowPlaying(await fetchJson(url));
+}
+
+export async function fetchListeners(): Promise<number | null> {
+  const url = (await siteSettings.get("radio_listeners_api_url", "")) ?? "";
+  if (!url) return null;
+  const d = await fetchJson(url);
+  if (d == null) return null;
+  const obj = d as { listeners?: unknown; current_listeners?: unknown };
+  const raw =
+    typeof d === "number"
+      ? d
+      : (obj.listeners ?? obj.current_listeners ?? (typeof d === "string" ? Number(d) : null));
+  const n = Number(
+    typeof raw === "object" && raw && "total" in (raw as Record<string, unknown>)
+      ? (raw as { total: unknown }).total
+      : raw,
+  );
+  return Number.isFinite(n) ? n : null;
+}