perf(app): batch catalog updates, tune caches, add captcha env fallback

- catalog: apply bulk offer edits in a single transaction with one RCON
  refresh instead of N round-trips, virtualize the items table past 150
  rows and cap the shop preview at 200 tiles
- cache: lift the public cache TTLs and the boot warm-up into env-tunable
  constants (src/lib/perf-ttls.ts; CMS_*_TTL_SEC, CMS_WARMUP_ENABLED)
- auth: resolve the captcha provider, site key and secret from
  CAPTCHA_PROVIDER, TURNSTILE_SITE_KEY and TURNSTILE_SECRET_KEY when the
  admin settings are unset; an explicit DB value (including "none") still
  wins, so Turnstile can be enabled per-deploy without touching the DB.

src/lib/services/site-settings.ts

@@ -2,6 +2,10 @@ import "server-only";
 
 import { db, WebsiteSetting } from "@/lib/db";
 import { logger } from "@/lib/logger";
+import {
+	SITE_SETTINGS_MEMORY_TTL_MS,
+	SITE_SETTINGS_TTL_MS,
+} from "@/lib/perf-ttls";
 import { redis } from "@/lib/redis";
 
 const DEFAULTS: Record<string, string> = {
@@ -11,12 +15,12 @@ const DEFAULTS: Record<string, string> = {
 	habbo_gamedata_hotel: "it",
 };
 
-const CACHE_TTL_MS = 300_000;
+const CACHE_TTL_MS = SITE_SETTINGS_TTL_MS;
 const REDIS_CACHE_KEY = "site_settings";
 // Short in-process window so repeated getters in one request (header, nav,
 // footer all read logo and other settings) don't each pay a Redis round-trip.
 // Redis stays the source of truth across instances.
-const MEMORY_TTL_MS = 60_000;
+const MEMORY_TTL_MS = SITE_SETTINGS_MEMORY_TTL_MS;
 
 // During `next build`, pages are prerendered and `Date.now()` is treated as an
 // unstable prerender value — always serve the in-process cache then (settings