Add remaining public + admin pages (parallel build, 26 files)

Built via two parallel agent workflows reading the real Prisma schema, then
integrated + verified.

Public: /shop (categories + storefront), /community hub, /rankings (top by
credits), /staff, /photos (camera_web gallery), /help (categories + rules),
/help/tickets (auth-gated user tickets + create), /settings (auth-gated, update
motto via RCON).

Admin: /admin/catalog (+[id] items), /admin/radio (shouts/apps/schedules +
delete shout), /admin/teams (CRUD), /admin/permissions (read), /admin/wordfilter
(CRUD + RCON push), /admin/ip (whitelist/blacklist CRUD), /admin/applications
(list + dismiss), /admin/logs (chat/command/alert read), /admin/achievements
(read). Server actions all staff-gated.

Header + admin nav extended. Verified: tsc exit 0, vitest 48/48, next build
exit 0 (33 routes); curl-probed every route — public 200/<main>, auth+admin
correctly 307-redirect when unauthorized.

src/actions/help-tickets.ts

@@ -0,0 +1,30 @@
+"use server";
+
+import { revalidatePath } from "next/cache";
+import { auth } from "@/lib/auth";
+import { prisma } from "@/lib/prisma";
+
+export async function createTicket(formData: FormData): Promise<void> {
+  // Re-read the session user id server-side; never trust a form-supplied id.
+  const session = await auth();
+  const userId = Number(session?.user?.id);
+  if (!Number.isInteger(userId) || userId <= 0) return;
+
+  const title = String(formData.get("title") ?? "").trim().slice(0, 255);
+  const content = String(formData.get("content") ?? "").trim().slice(0, 5000);
+  if (!title || !content) return;
+
+  const now = new Date();
+  await prisma.websiteHelpCenterTickets.create({
+    data: {
+      userId,
+      title,
+      content,
+      open: true,
+      createdAt: now,
+      updatedAt: now,
+    },
+  });
+
+  revalidatePath("/help/tickets");
+}