feat: public events/polls, friends graph, captcha, SSE hardening, and admin UX

Ship product gaps: register/vote pages, friend add/accept/decline/remove, email verify TTL, captcha on login/forgot, soft-fail user actions, SSE abort/shared client, Commando Centrum error toasts, admin delete for events/polls, and IT/NL i18n fills.

Co-authored-by: Cursor <[email protected]>

src/app/admin/layout.tsx

@@ -14,6 +14,8 @@ import { setCsrfCookie } from "@/lib/foundation/security";
 import { prisma } from "@/lib/prisma";
 import { siteSettings } from "@/lib/services/site-settings";
 
+// Request-time auth: requireStaff, CSRF cookie, and optional 2FA gate cannot be
+// statically rendered. Child admin pages inherit this — leaf force-dynamic is redundant.
 export const dynamic = "force-dynamic";
 
 export default async function AdminLayout({