perf(app): batch catalog updates, tune caches, add captcha env fallback

- catalog: apply bulk offer edits in a single transaction with one RCON
  refresh instead of N round-trips, virtualize the items table past 150
  rows and cap the shop preview at 200 tiles
- cache: lift the public cache TTLs and the boot warm-up into env-tunable
  constants (src/lib/perf-ttls.ts; CMS_*_TTL_SEC, CMS_WARMUP_ENABLED)
- auth: resolve the captcha provider, site key and secret from
  CAPTCHA_PROVIDER, TURNSTILE_SITE_KEY and TURNSTILE_SECRET_KEY when the
  admin settings are unset; an explicit DB value (including "none") still
  wins, so Turnstile can be enabled per-deploy without touching the DB.

src/lib/services/public-counters.ts

@@ -3,6 +3,9 @@ import "server-only";
 import { and, count, eq, or, sql } from "drizzle-orm";
 import { cached } from "@/lib/cache";
 import { CameraWeb, db, Rooms, User, WebsiteArticles } from "@/lib/db";
+import { ONLINE_COUNT_TTL_MS } from "@/lib/perf-ttls";
+
+export { ONLINE_COUNT_TTL_MS };
 
 /**
  * Row counters for the public homepage.
@@ -80,9 +83,8 @@ export async function countOnline(): Promise<number> {
 // One function for every caller (homepage, login, register, headers, the client
 // page and the warm-up). Each call site used to inline this, and the ones that
 // omitted `staleMs` wrote an entry without a grace window, which made the key
-// block on COUNT(*) at every TTL boundary.
-export const ONLINE_COUNT_TTL_MS = 10_000;
-
+// block on COUNT(*) at every TTL boundary. The TTL itself is env-tuned via
+// perf-ttls (CMS_ONLINE_COUNT_TTL_SEC).
 export async function cachedOnlineCount(): Promise<number> {
 	return cached("online_count", ONLINE_COUNT_TTL_MS, countOnline, {
 		staleMs: 15_000,