fix: production hardening — migration script, security fixes, structured logging, API docs, component splitting

- Create apply-migrations.ts and jobs-worker.ts scripts (package.json references)
- Convert badge leaderboard from $queryRawUnsafe to $queryRaw with Prisma.sql templates
- Fix OAuth email binding: add oauth_require_link site setting, skip 2FA-protected accounts
- Add per-user 2FA rate limiting (5/30s) to prevent TOTP brute-force
- Add structured JSON logger with levels (debug/info/warn/error)
- Split 341-line HomePage into GuestView + UserView components
- Add OpenAPI v3.1 spec at /api/openapi.json
- Add LOG_LEVEL env var, regenerate Prisma client
- Add mysql2 dependency for migration scripts
- All 58 tests pass, typecheck clean

src/lib/logger.test.ts

@@ -0,0 +1,16 @@
+import { describe, expect, it } from "vitest";
+import { generateRequestId } from "./logger";
+
+describe("generateRequestId", () => {
+  it("produces a non-empty string", () => {
+    const id = generateRequestId();
+    expect(id).toBeTruthy();
+    expect(typeof id).toBe("string");
+  });
+
+  it("produces unique values on successive calls", () => {
+    const a = generateRequestId();
+    const b = generateRequestId();
+    expect(a).not.toBe(b);
+  });
+});