perf(app): batch catalog updates, tune caches, add captcha env fallback

- catalog: apply bulk offer edits in a single transaction with one RCON
  refresh instead of N round-trips, virtualize the items table past 150
  rows and cap the shop preview at 200 tiles
- cache: lift the public cache TTLs and the boot warm-up into env-tunable
  constants (src/lib/perf-ttls.ts; CMS_*_TTL_SEC, CMS_WARMUP_ENABLED)
- auth: resolve the captcha provider, site key and secret from
  CAPTCHA_PROVIDER, TURNSTILE_SITE_KEY and TURNSTILE_SECRET_KEY when the
  admin settings are unset; an explicit DB value (including "none") still
  wins, so Turnstile can be enabled per-deploy without touching the DB.

src/lib/services/cache-warmup.ts

@@ -4,6 +4,11 @@ import { asc, desc, eq, gte } from "drizzle-orm";
 import { cached } from "@/lib/cache";
 import { CameraWeb, db, User, WebsiteTeams } from "@/lib/db";
 import { logger } from "@/lib/logger";
+import {
+	CACHE_WARMUP_ENABLED,
+	COUNTERS_TTL_MS,
+	ONLINE_COUNT_TTL_MS,
+} from "@/lib/perf-ttls";
 import { apiCacheKey, redisCache } from "@/lib/redis-cache";
 import { cachedHomePayload } from "@/lib/services/home-payload";
 import { getNewsList } from "@/lib/services/news-list";
@@ -30,8 +35,8 @@ import { siteSettings } from "@/lib/services/site-settings";
  * stop the server from serving.
  */
 
-const COUNTER_TTL_MS = 300_000;
-const ONLINE_TTL_MS = 10_000;
+const COUNTER_TTL_MS = COUNTERS_TTL_MS;
+const ONLINE_TTL_MS = ONLINE_COUNT_TTL_MS;
 
 async function warm<T>(name: string, load: () => Promise<T>): Promise<void> {
 	try {
@@ -45,6 +50,10 @@ async function warm<T>(name: string, load: () => Promise<T>): Promise<void> {
 }
 
 export async function warmPublicCaches(): Promise<void> {
+	// Boot warm-up can be turned off per deploy (CMS_WARMUP_ENABLED=false): on
+	// small hosts a burst of COUNT(*) queries right after boot competes with the
+	// emulator for the same database.
+	if (!CACHE_WARMUP_ENABLED) return;
 	// Elke `warm` wordt afgewacht voordat de volgende begint, dus de COUNT(*)
 	// queries gaan één voor één in plaats van als een burst op een database die
 	// nog aan het opstarten is. Dat is goed genoeg; kunstmatige sleeps zouden