perf(app): batch catalog updates, tune caches, add captcha env fallback

- catalog: apply bulk offer edits in a single transaction with one RCON
  refresh instead of N round-trips, virtualize the items table past 150
  rows and cap the shop preview at 200 tiles
- cache: lift the public cache TTLs and the boot warm-up into env-tunable
  constants (src/lib/perf-ttls.ts; CMS_*_TTL_SEC, CMS_WARMUP_ENABLED)
- auth: resolve the captcha provider, site key and secret from
  CAPTCHA_PROVIDER, TURNSTILE_SITE_KEY and TURNSTILE_SECRET_KEY when the
  admin settings are unset; an explicit DB value (including "none") still
  wins, so Turnstile can be enabled per-deploy without touching the DB.

src/lib/services/news-list.ts

@@ -1,4 +1,5 @@
 import { logger } from "@/lib/logger";
+import { NEWS_LIST_TTL_MS } from "@/lib/perf-ttls";
 import { cacheNews } from "@/lib/services/news-cache";
 import "server-only";
 
@@ -21,7 +22,7 @@ interface NewsListRow {
 	createdAt: Date | null;
 }
 
-const TTL_MS = 300_000;
+const TTL_MS = NEWS_LIST_TTL_MS;
 const CACHE_KEY = "news_list";
 const FETCH_LIMIT = 30;