Add security middleware, audit log, alerts, PayPal, cron, radio + apps

Security (launch blockers):
- src/middleware.ts (edge): forwards x-pathname + real client IP.
- access-guard.ts (Node, from root layout): routes non-staff to /maintenance
  when maintenance mode is on, banned users to /banned. New /banned + /maintenance
  pages (the consumers the admin toggle was missing). Admin layout enforces
  force_staff_2fa before /admin.
- staff-activity.ts audit log wired into ban/lift/give-currency/set-rank actions.

Infra (parallel agents): alert service (alert_logs + Discord embed + email),
PayPal top-up (create/capture API routes + /shop/topup), cron worker
(scripts/jobs-worker.ts via croner: emulator-ping->alert, maintenance-check,
bans-cleanup), social connections page, admin radio settings/banners/ranks.
Public radio subsystem: /radio (+schedule, shouts+post, contests, giveaways,
apply, leaderboard) and /apply/staff + /apply/team submission forms. Radio nav
link added. .env.example documents the new optional vars.

(radio song-requests dropped: its table is a stub in AtomCMS — columns added by
un-modeled alter-migrations.)

Verified: tsc exit 0, vitest 48/48, next build exit 0 (82 page routes).

src/app/radio/shouts/page.tsx

@@ -0,0 +1,115 @@
+import { auth } from "@/lib/auth";
+import { avatarImageUrl } from "@/lib/format";
+import { prisma } from "@/lib/prisma";
+import { siteSettings } from "@/lib/services/site-settings";
+import { postShout } from "@/actions/radio-shouts";
+
+export const dynamic = "force-dynamic";
+
+function formatDate(d: Date | null | undefined): string {
+  return d ? d.toISOString().slice(0, 16).replace("T", " ") : "";
+}
+
+export default async function RadioShoutsPage() {
+  const [shouts, imagerBase, session] = await Promise.all([
+    prisma.radioShouts
+      .findMany({
+        orderBy: { createdAt: "desc" },
+        take: 50,
+      })
+      .catch(() => []),
+    siteSettings.get(
+      "habbo_imaging_url",
+      "https://www.habbo.com/habbo-imaging/avatarimage",
+    ),
+    auth(),
+  ]);
+
+  const isLoggedIn = Boolean(session?.user?.id);
+
+  // Resolve author usernames/looks. shout.userId is BigInt; User.id is Int.
+  const authorIds = Array.from(new Set(shouts.map((s) => Number(s.userId))));
+  const authors = authorIds.length
+    ? await prisma.user
+        .findMany({
+          where: { id: { in: authorIds } },
+          select: { id: true, username: true, look: true },
+        })
+        .catch(() => [])
+    : [];
+  const authorById = new Map(authors.map((a) => [a.id, a]));
+
+  return (
+    <main>
+      <h1>Radio Shouts</h1>
+      <p className="muted" style={{ marginTop: 0 }}>
+        Shout-outs and requests from the community.
+      </p>
+
+      {isLoggedIn ? (
+        <form action={postShout} className="card" style={{ marginBottom: "1.5rem" }}>
+          {/* The author is taken from the session inside the action, never from
+              this form — no user id is submitted. */}
+          <label htmlFor="shout-message" className="muted">
+            Post a shout
+          </label>
+          <textarea
+            id="shout-message"
+            name="message"
+            required
+            maxLength={255}
+            rows={3}
+            placeholder="Send a shout to the DJ…"
+            style={{ width: "100%", margin: "0.4rem 0 0.75rem", resize: "vertical" }}
+          />
+          <button type="submit" className="btn btn-primary">
+            Shout
+          </button>
+        </form>
+      ) : (
+        <p className="muted">Log in to post a shout.</p>
+      )}
+
+      {shouts.length === 0 ? (
+        <p className="muted">No shouts yet. Be the first!</p>
+      ) : (
+        <div className="grid">
+          {shouts.map((s) => {
+            const author = authorById.get(Number(s.userId));
+            const authorAvatar = author
+              ? avatarImageUrl(imagerBase ?? "", author.look, {
+                  size: "s",
+                  headOnly: true,
+                })
+              : null;
+            return (
+              <div
+                key={String(s.id)}
+                className="card"
+                style={{ display: "flex", gap: "0.75rem", alignItems: "flex-start" }}
+              >
+                {authorAvatar ? (
+                  /* eslint-disable-next-line @next/next/no-img-element */
+                  <img
+                    className="avatar"
+                    src={authorAvatar}
+                    alt={author?.username ?? "author"}
+                    width={40}
+                    height={40}
+                  />
+                ) : null}
+                <div style={{ flex: 1 }}>
+                  <p style={{ margin: "0 0 0.25rem" }}>
+                    <strong>{author?.username ?? `User #${s.userId}`}</strong>{" "}
+                    <span className="muted">{formatDate(s.createdAt)}</span>
+                  </p>
+                  <p style={{ margin: 0 }}>{s.message}</p>
+                </div>
+              </div>
+            );
+          })}
+        </div>
+      )}
+    </main>
+  );
+}