perf(app): batch catalog updates, tune caches, add captcha env fallback

- catalog: apply bulk offer edits in a single transaction with one RCON
  refresh instead of N round-trips, virtualize the items table past 150
  rows and cap the shop preview at 200 tiles
- cache: lift the public cache TTLs and the boot warm-up into env-tunable
  constants (src/lib/perf-ttls.ts; CMS_*_TTL_SEC, CMS_WARMUP_ENABLED)
- auth: resolve the captcha provider, site key and secret from
  CAPTCHA_PROVIDER, TURNSTILE_SITE_KEY and TURNSTILE_SECRET_KEY when the
  admin settings are unset; an explicit DB value (including "none") still
  wins, so Turnstile can be enabled per-deploy without touching the DB.

src/lib/services/news-archive.ts

@@ -1,6 +1,7 @@
 import "server-only";
 import { and, asc, count, desc, eq, like, or, sql } from "drizzle-orm";
 import { db, WebsiteArticles } from "@/lib/db";
+import { NEWS_ARCHIVE_TTL_MS } from "@/lib/perf-ttls";
 import { cacheSafe } from "@/lib/redis-cache";
 import { cacheNews } from "@/lib/services/news-cache";
 
@@ -12,7 +13,7 @@ import { cacheNews } from "@/lib/services/news-cache";
  * entries immediately, so the window only applies when pub/sub cannot be
  * delivered.
  */
-const ARCHIVE_TTL_MS = 60_000;
+const ARCHIVE_TTL_MS = NEWS_ARCHIVE_TTL_MS;
 
 async function queryNewsArchive(
 	options: { search?: string; page?: number; order?: string } = {},