perf(app): batch catalog updates, tune caches, add captcha env fallback

- catalog: apply bulk offer edits in a single transaction with one RCON
  refresh instead of N round-trips, virtualize the items table past 150
  rows and cap the shop preview at 200 tiles
- cache: lift the public cache TTLs and the boot warm-up into env-tunable
  constants (src/lib/perf-ttls.ts; CMS_*_TTL_SEC, CMS_WARMUP_ENABLED)
- auth: resolve the captcha provider, site key and secret from
  CAPTCHA_PROVIDER, TURNSTILE_SITE_KEY and TURNSTILE_SECRET_KEY when the
  admin settings are unset; an explicit DB value (including "none") still
  wins, so Turnstile can be enabled per-deploy without touching the DB.

src/lib/services/home-payload.ts

@@ -3,6 +3,7 @@ import "server-only";
 import { and, count, desc, eq, or, sql } from "drizzle-orm";
 import { db, User, WebsiteArticles } from "@/lib/db";
 import { resolveHotelName } from "@/lib/hotel-name";
+import { HOME_PAYLOAD_TTL_MS } from "@/lib/perf-ttls";
 import { apiCacheKey, cacheSafe } from "@/lib/redis-cache";
 import { cacheNews } from "@/lib/services/news-cache";
 
@@ -47,5 +48,5 @@ export async function loadHomePayload() {
 
 /** Cached read of {@link loadHomePayload} under the route's own key. */
 export async function cachedHomePayload() {
-	return cacheNews(apiCacheKey("home"), 15_000, loadHomePayload);
+	return cacheNews(apiCacheKey("home"), HOME_PAYLOAD_TTL_MS, loadHomePayload);
 }