fix: production hardening — migration script, security fixes, structured logging, API docs, component splitting

- Create apply-migrations.ts and jobs-worker.ts scripts (package.json references)
- Convert badge leaderboard from $queryRawUnsafe to $queryRaw with Prisma.sql templates
- Fix OAuth email binding: add oauth_require_link site setting, skip 2FA-protected accounts
- Add per-user 2FA rate limiting (5/30s) to prevent TOTP brute-force
- Add structured JSON logger with levels (debug/info/warn/error)
- Split 341-line HomePage into GuestView + UserView components
- Add OpenAPI v3.1 spec at /api/openapi.json
- Add LOG_LEVEL env var, regenerate Prisma client
- Add mysql2 dependency for migration scripts
- All 58 tests pass, typecheck clean

.env.example

@@ -69,3 +69,7 @@ PAYPAL_API=https://api-m.sandbox.paypal.com
 # allowing horizontal scaling across multiple instances. Falls back to in-process
 # Maps when unset.
 REDIS_URL=redis://127.0.0.1:6379
+
+# Logging level (debug | info | warn | error). Defaults to 'info' in production,
+# 'debug' in development.
+LOG_LEVEL=info