Add 2FA, email + password reset, and batch-7 pages

Auth (hand-built on the auth core):
- 2FA: User model gains two_factor_secret/recovery_codes/confirmed_at (+ idempotent
  MariaDB migration). authorize() requires a valid TOTP code when 2FA is confirmed
  (secret decrypted via Laravel APP_KEY, fail-closed). Two-step login (precheckLogin
  reveals the code field). /settings/2fa enable/confirm/disable flow.
- Password reset: nodemailer email service; PasswordReset model + migration;
  /forgot (request, generic response) + /reset (token sha256 + 1h TTL, sets argon2id
  hash). Login links to forgot.

Batch 7 (parallel agents): /admin/commandocentrum (RCON controls + emulator_errors),
social write actions (friend request + guild forum new thread), /help/[category],
/badges (public). env: APP_KEY, APP_URL, SMTP_*. Nav extended.

Verified: tsc exit 0, vitest 48/48, next build exit 0 (64 page routes).

src/app/admin/commandocentrum/page.tsx

@@ -0,0 +1,150 @@
+import {
+  hotelAlert,
+  updateCatalog,
+  updateNavigator,
+  updateWordFilter,
+} from "@/actions/commandocentrum";
+import { prisma } from "@/lib/prisma";
+
+export const dynamic = "force-dynamic";
+
+function formatTimestamp(ts: number | null | undefined): string {
+  if (!ts) return "";
+  return new Date(ts * 1000).toISOString().slice(0, 19).replace("T", " ");
+}
+
+// stacktrace is a MySQL BLOB (Prisma `Bytes`), so it arrives as a Buffer/
+// Uint8Array. Decode to UTF-8 and trim to a single readable preview line.
+function decodeStacktrace(raw: unknown): string {
+  if (raw == null) return "";
+  try {
+    if (typeof raw === "string") return raw;
+    return Buffer.from(raw as Uint8Array).toString("utf8");
+  } catch {
+    return "";
+  }
+}
+
+export default async function CommandoCentrum() {
+  const errors = await prisma.emulatorErrors
+    .findMany({
+      orderBy: { timestamp: "desc" },
+      take: 50,
+    })
+    .catch(() => []);
+
+  return (
+    <main>
+      <h1>Commandocentrum</h1>
+      <p className="muted" style={{ marginTop: "-0.25rem" }}>
+        Emulator control center — push live reloads and broadcast alerts over RCON.
+      </p>
+
+      {/* ── RCON controls ──────────────────────────────────────── */}
+      <section style={{ marginTop: "1.5rem" }}>
+        <h2>Emulator controls</h2>
+        <div className="grid cols-3">
+          <form action={updateCatalog} className="card">
+            <h3 style={{ marginTop: 0 }}>Update catalog</h3>
+            <p className="muted" style={{ margin: "0 0 0.85rem" }}>
+              Reload catalog pages and items on the live server.
+            </p>
+            <button type="submit" className="btn btn-primary">
+              Update catalog
+            </button>
+          </form>
+
+          <form action={updateWordFilter} className="card">
+            <h3 style={{ marginTop: 0 }}>Update word filter</h3>
+            <p className="muted" style={{ margin: "0 0 0.85rem" }}>
+              Reload the chat word filter from the database.
+            </p>
+            <button type="submit" className="btn btn-primary">
+              Update word filter
+            </button>
+          </form>
+
+          <form action={updateNavigator} className="card">
+            <h3 style={{ marginTop: 0 }}>Update navigator</h3>
+            <p className="muted" style={{ margin: "0 0 0.85rem" }}>
+              Reload navigator categories and room listings.
+            </p>
+            <button type="submit" className="btn btn-primary">
+              Update navigator
+            </button>
+          </form>
+        </div>
+
+        <form action={hotelAlert} className="card" style={{ marginTop: "1rem" }}>
+          <h3 style={{ marginTop: 0 }}>Hotel alert</h3>
+          <p className="muted" style={{ margin: "0 0 0.75rem" }}>
+            Broadcast a message to every connected user.
+          </p>
+          <div style={{ display: "flex", gap: "0.5rem", flexWrap: "wrap" }}>
+            <input
+              name="message"
+              required
+              maxLength={512}
+              placeholder="Message to broadcast…"
+              style={{ flex: 1, minWidth: 220 }}
+            />
+            <button type="submit" className="btn btn-danger">
+              Send alert
+            </button>
+          </div>
+        </form>
+      </section>
+
+      {/* ── Emulator errors ────────────────────────────────────── */}
+      <section style={{ marginTop: "1.5rem" }}>
+        <h2>Recent emulator errors</h2>
+        {errors.length === 0 ? (
+          <p className="muted">No emulator errors logged.</p>
+        ) : (
+          <div className="card" style={{ overflowX: "auto" }}>
+            <table>
+              <thead>
+                <tr>
+                  <th>When</th>
+                  <th>Type</th>
+                  <th>Version</th>
+                  <th>Stacktrace</th>
+                </tr>
+              </thead>
+              <tbody>
+                {errors.map((e) => {
+                  const trace = decodeStacktrace(e.stacktrace);
+                  return (
+                    <tr key={e.id}>
+                      <td className="muted" style={{ whiteSpace: "nowrap" }}>
+                        {formatTimestamp(e.timestamp)}
+                      </td>
+                      <td>{e.type}</td>
+                      <td className="muted" style={{ whiteSpace: "nowrap" }}>
+                        {e.version}
+                      </td>
+                      <td>
+                        <pre
+                          style={{
+                            margin: 0,
+                            maxHeight: 160,
+                            overflow: "auto",
+                            fontSize: "0.75rem",
+                            whiteSpace: "pre-wrap",
+                            wordBreak: "break-word",
+                          }}
+                        >
+                          {trace || "(empty)"}
+                        </pre>
+                      </td>
+                    </tr>
+                  );
+                })}
+              </tbody>
+            </table>
+          </div>
+        )}
+      </section>
+    </main>
+  );
+}

src/app/admin/layout.tsx

@@ -39,6 +39,7 @@ export default async function AdminLayout({ children }: { children: ReactNode })
           <Link href="/admin/housekeeping">Housekeeping</Link>
           <Link href="/admin/permissions">Permissions</Link>
           <Link href="/admin/emulator">Emulator</Link>
+          <Link href="/admin/commandocentrum">Commandocentrum</Link>
           <Link href="/admin/email-templates">Email</Link>
           <Link href="/admin/settings">Settings</Link>
         </nav>