perf(app): batch catalog updates, tune caches, add captcha env fallback

- catalog: apply bulk offer edits in a single transaction with one RCON
  refresh instead of N round-trips, virtualize the items table past 150
  rows and cap the shop preview at 200 tiles
- cache: lift the public cache TTLs and the boot warm-up into env-tunable
  constants (src/lib/perf-ttls.ts; CMS_*_TTL_SEC, CMS_WARMUP_ENABLED)
- auth: resolve the captcha provider, site key and secret from
  CAPTCHA_PROVIDER, TURNSTILE_SITE_KEY and TURNSTILE_SECRET_KEY when the
  admin settings are unset; an explicit DB value (including "none") still
  wins, so Turnstile can be enabled per-deploy without touching the DB.

.env.example

@@ -18,6 +18,21 @@ CACHE_MEMORY_MAX_ENTRIES=2000
 # every 5 minutes brings an over-budget directory back to 90% of this (default 20000).
 IMAGING_CACHE_MAX_ENTRIES=20000
 
+# --- CACHE TTL TUNING (seconds; defaults apply when unset) ---
+# Higher = less DB load but staler data. Publishing news rotates its cache
+# revision immediately, so news TTLs only delay content that bypasses that path.
+CMS_HOME_PAYLOAD_TTL_SEC=15
+CMS_NEWS_LIST_TTL_SEC=300
+CMS_NEWS_ARCHIVE_TTL_SEC=60
+CMS_SEARCH_TTL_SEC=30
+CMS_ONLINE_COUNT_TTL_SEC=10
+CMS_COUNTERS_TTL_SEC=300
+CMS_SITE_SETTINGS_TTL_SEC=300
+CMS_SITE_SETTINGS_MEMORY_TTL_SEC=60
+# Boot-time cache warm-up (primes hot keys after each deploy). Set false on
+# tiny hosts where the boot COUNT(*) burst is undesirable.
+CMS_WARMUP_ENABLED=true
+
 # --- CORE RUNTIME & PERFORMANCE FLAGS ---
 NODE_ENV=production
 PORT=3002
@@ -78,6 +93,14 @@ CLOUDFLARE_AUTO_BLOCK_ENABLED=true
 # Override for tests/staging (production uses the public endpoint by default).
 CLOUDFLARE_API_BASE_URL=https://api.cloudflare.com/client/v4
 
+# --- CAPTCHA (env fallback; admin settings win when set) ---
+# Enable Turnstile on register/login/forgot/resend without touching the DB.
+# "none" (default), "turnstile", "recaptcha" or "hcaptcha".
+CAPTCHA_PROVIDER=
+# Cloudflare Turnstile keys from https://dash.cloudflare.com/turnstile
+TURNSTILE_SITE_KEY=
+TURNSTILE_SECRET_KEY=
+
 # --- PATHS ---
 BADGE_UPLOAD_DIR=./public/assets/images/badges
 EMULATOR_JAR_PATH=./emulator/Arcturus.jar