Add niche admin + public expansions + self-host Nunito font (batches 3-4)

Built via two more parallel agent workflows (read schema -> return files),
integrated + verified.

Admin: /admin/emulator (emulator_settings + emulator_texts key/value editor),
/admin/badges (give-badge via RCON), /admin/rare-values (CRUD), /admin/housekeeping
(CRUD), /admin/email-templates (CRUD), /admin/photos (moderation).
Public: /rares (+[category]), /leaderboard (credits/diamonds/duckets),
/guilds (+[id] members), /redeem (voucher -> sendCurrency).
Expanded: /u/[username] now shows badges + photos + guestbook (post form);
/news/[slug] now shows reactions + comments (comment form). Reactions tallied
in JS (Prisma groupBy typing avoided).
Self-hosted Nunito via next/font/google wired to --font-nunito (the atom theme
font, no runtime external fetch). Header + admin nav extended.

Verified: tsc exit 0, vitest 48/48, next build exit 0.

src/actions/admin-housekeeping.ts

@@ -0,0 +1,47 @@
+"use server";
+
+import { revalidatePath } from "next/cache";
+import { requireStaff } from "@/lib/admin/guard";
+import { prisma } from "@/lib/prisma";
+
+/**
+ * Create or update a housekeeping permission (keyed by the unique `permission`
+ * string). Mirrors AtomCMS' housekeeping permission management.
+ */
+export async function upsertPermission(formData: FormData): Promise<void> {
+  await requireStaff();
+
+  const permission = String(formData.get("permission") ?? "").trim().slice(0, 255);
+  const minRank = Number(formData.get("minRank"));
+  const descriptionRaw = String(formData.get("description") ?? "").trim().slice(0, 255);
+  const description = descriptionRaw.length > 0 ? descriptionRaw : null;
+
+  if (!permission || !Number.isFinite(minRank) || minRank < 0) return;
+
+  try {
+    await prisma.websiteHousekeepingPermissions.upsert({
+      where: { permission },
+      update: { minRank, description },
+      create: { permission, minRank, description },
+    });
+  } catch {
+    // Swallow: duplicate/constraint issues shouldn't crash the action.
+  }
+
+  revalidatePath("/admin/housekeeping");
+}
+
+export async function deletePermission(formData: FormData): Promise<void> {
+  await requireStaff();
+
+  const raw = String(formData.get("id") ?? "");
+  if (!raw) return;
+
+  try {
+    await prisma.websiteHousekeepingPermissions.delete({ where: { id: BigInt(raw) } });
+  } catch {
+    // Already gone / invalid id.
+  }
+
+  revalidatePath("/admin/housekeeping");
+}