perf(app): batch catalog updates, tune caches, add captcha env fallback

- catalog: apply bulk offer edits in a single transaction with one RCON
  refresh instead of N round-trips, virtualize the items table past 150
  rows and cap the shop preview at 200 tiles
- cache: lift the public cache TTLs and the boot warm-up into env-tunable
  constants (src/lib/perf-ttls.ts; CMS_*_TTL_SEC, CMS_WARMUP_ENABLED)
- auth: resolve the captcha provider, site key and secret from
  CAPTCHA_PROVIDER, TURNSTILE_SITE_KEY and TURNSTILE_SECRET_KEY when the
  admin settings are unset; an explicit DB value (including "none") still
  wins, so Turnstile can be enabled per-deploy without touching the DB.

src/lib/services/public-search.ts

@@ -1,4 +1,5 @@
 import { cached } from "@/lib/cache";
+import { PUBLIC_SEARCH_TTL_MS } from "@/lib/perf-ttls";
 import { publicReadFailure } from "@/lib/services/public-read";
 import "server-only";
 import { and, asc, count, eq, inArray, like, or } from "drizzle-orm";
@@ -14,7 +15,7 @@ import { loadNewsArchive } from "@/lib/services/news-archive";
  * directory, and a user who registers or a room that opens should show up
  * without waiting.
  */
-const SEARCH_TTL_MS = 30_000;
+const SEARCH_TTL_MS = PUBLIC_SEARCH_TTL_MS;
 
 function pageNumber(value: number | undefined, total: number) {
 	return Math.min(