feat: public events/polls, friends graph, captcha, SSE hardening, and admin UX

Ship product gaps: register/vote pages, friend add/accept/decline/remove, email verify TTL, captcha on login/forgot, soft-fail user actions, SSE abort/shared client, Commando Centrum error toasts, admin delete for events/polls, and IT/NL i18n fills.

Co-authored-by: Cursor <[email protected]>

src/actions/password-reset.ts

@@ -6,6 +6,7 @@ import { env } from "@/env";
 import { hashPassword } from "@/lib/auth/password";
 import { prisma } from "@/lib/prisma";
 import { clientIp, rateLimit } from "@/lib/rate-limit";
+import { captchaConfig, verifyCaptcha } from "@/lib/services/captcha";
 import { sendMail } from "@/lib/services/email";
 
 const TOKEN_TTL_MS = 60 * 60 * 1000; // 1 hour
@@ -20,9 +21,19 @@ export async function requestReset(formData: FormData): Promise<void> {
 		.trim()
 		.toLowerCase();
 
+	const ip = await clientIp();
+
+	// CAPTCHA when a provider is configured (mirrors register).
+	const cfg = await captchaConfig();
+	if (cfg.provider !== "none") {
+		const token = String(formData.get(cfg.field) ?? "").normalize("NFC");
+		if (!(await verifyCaptcha(token, ip))) {
+			redirect("/forgot?error=captcha");
+		}
+	}
+
 	// Throttle reset requests per IP (3 per 15 min) to curb email-bomb abuse.
-	const allowed = (await rateLimit(`reset:${await clientIp()}`, 3, 15 * 60_000))
-		.ok;
+	const allowed = (await rateLimit(`reset:${ip}`, 3, 15 * 60_000)).ok;
 
 	// Always respond the same way so we don't reveal which emails exist.
 	if (allowed && /^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) {