Add remaining public + admin pages (parallel build, 26 files)

Built via two parallel agent workflows reading the real Prisma schema, then
integrated + verified.

Public: /shop (categories + storefront), /community hub, /rankings (top by
credits), /staff, /photos (camera_web gallery), /help (categories + rules),
/help/tickets (auth-gated user tickets + create), /settings (auth-gated, update
motto via RCON).

Admin: /admin/catalog (+[id] items), /admin/radio (shouts/apps/schedules +
delete shout), /admin/teams (CRUD), /admin/permissions (read), /admin/wordfilter
(CRUD + RCON push), /admin/ip (whitelist/blacklist CRUD), /admin/applications
(list + dismiss), /admin/logs (chat/command/alert read), /admin/achievements
(read). Server actions all staff-gated.

Header + admin nav extended. Verified: tsc exit 0, vitest 48/48, next build
exit 0 (33 routes); curl-probed every route — public 200/<main>, auth+admin
correctly 307-redirect when unauthorized.

src/actions/admin-ip.ts

@@ -0,0 +1,52 @@
+"use server";
+
+import { revalidatePath } from "next/cache";
+import { requireStaff } from "@/lib/admin/guard";
+import { prisma } from "@/lib/prisma";
+
+function parseIp(formData: FormData): string {
+  return String(formData.get("ipAddress") ?? "").trim().slice(0, 255);
+}
+
+function parseAsn(formData: FormData): string | null {
+  const asn = String(formData.get("asn") ?? "").trim().slice(0, 255);
+  return asn || null;
+}
+
+export async function addWhitelist(formData: FormData): Promise<void> {
+  await requireStaff();
+  const ipAddress = parseIp(formData);
+  if (!ipAddress) return;
+  const asn = parseAsn(formData);
+  await prisma.websiteIpWhitelist.create({
+    data: { ipAddress, asn, whitelistAsn: asn != null },
+  });
+  revalidatePath("/admin/ip");
+}
+
+export async function deleteWhitelist(formData: FormData): Promise<void> {
+  await requireStaff();
+  const raw = String(formData.get("id") ?? "").trim();
+  if (!raw) return;
+  await prisma.websiteIpWhitelist.delete({ where: { id: BigInt(raw) } });
+  revalidatePath("/admin/ip");
+}
+
+export async function addBlacklist(formData: FormData): Promise<void> {
+  await requireStaff();
+  const ipAddress = parseIp(formData);
+  if (!ipAddress) return;
+  const asn = parseAsn(formData);
+  await prisma.websiteIpBlacklist.create({
+    data: { ipAddress, asn, blacklistAsn: asn != null },
+  });
+  revalidatePath("/admin/ip");
+}
+
+export async function deleteBlacklist(formData: FormData): Promise<void> {
+  await requireStaff();
+  const raw = String(formData.get("id") ?? "").trim();
+  if (!raw) return;
+  await prisma.websiteIpBlacklist.delete({ where: { id: BigInt(raw) } });
+  revalidatePath("/admin/ip");
+}