security: harden authentication (register/login)

- Username: restrict to [A-Za-z0-9_-], block reserved names (admin, mod, root, etc.),
  normalize NFC
- Password: min 12, max 128, require upper+lower+digit+special char
- Email: block disposable/temporary domains (mailinator, yopmail, etc.)
- Hashing: switch to Argon2id (memory-hard) via hash-wasm argon2id API
- Legacy hash migration: argon2/bcrypt/md5/sha1/sha256/sha512/salted/combined
  auto-upgrade to Argon2id on successful login
- Rate limits: 5/10min register, 10/5min login precheck per IP
- VPN/proxy block (configurable via /admin/vpn)
- Timing attack mitigation: dummy bcrypt hash for non-existent users
- Fixed typo in error message (R3 -> 3)
- Updated register.test.ts to match new validation rules

src/actions/draw-badge.test.ts

@@ -49,7 +49,7 @@ vi.mock("@/lib/server-log", () => ({ logServerError: mockLogServerError }));
 const mockGiveBadge = vi.hoisted(() => vi.fn());
 vi.mock("@/lib/services/rcon", () => ({ rcon: { giveBadge: mockGiveBadge } }));
 
-const mockSiteSettingsGet = vi.hoisted(() => vi.fn());
+const mockSiteSettingsGet = vi.hoisted(() => vi.fn(async () => state.price));
 vi.mock("@/lib/services/site-settings", () => ({
 	siteSettings: { get: mockSiteSettingsGet },
 }));
@@ -139,8 +139,6 @@ beforeEach(() => {
 	mockClientIp.mockResolvedValue("127.0.0.1");
 	mockRateLimit.mockReset();
 	mockRateLimit.mockResolvedValue({ ok: true });
-	mockSiteSettingsGet.mockReset();
-	mockSiteSettingsGet.mockResolvedValue(state.price);
 	mockGiveBadge.mockReset();
 	mockGiveBadge.mockResolvedValue(true);
 	state.badges = [];