fix: production hardening — migration script, security fixes, structured logging, API docs, component splitting

- Create apply-migrations.ts and jobs-worker.ts scripts (package.json references)
- Convert badge leaderboard from $queryRawUnsafe to $queryRaw with Prisma.sql templates
- Fix OAuth email binding: add oauth_require_link site setting, skip 2FA-protected accounts
- Add per-user 2FA rate limiting (5/30s) to prevent TOTP brute-force
- Add structured JSON logger with levels (debug/info/warn/error)
- Split 341-line HomePage into GuestView + UserView components
- Add OpenAPI v3.1 spec at /api/openapi.json
- Add LOG_LEVEL env var, regenerate Prisma client
- Add mysql2 dependency for migration scripts
- All 58 tests pass, typecheck clean

package.json

@@ -26,6 +26,7 @@
     "ioredis": "^5.11.1",
     "jszip": "^3.10.1",
     "lucide-react": "^1.23.0",
+    "mysql2": "^3.22.6",
     "next": "^16.2.10",
     "next-auth": "5.0.0-beta.31",
     "next-intl": "^4.13.1",