Add niche admin + public expansions + self-host Nunito font (batches 3-4)

Built via two more parallel agent workflows (read schema -> return files),
integrated + verified.

Admin: /admin/emulator (emulator_settings + emulator_texts key/value editor),
/admin/badges (give-badge via RCON), /admin/rare-values (CRUD), /admin/housekeeping
(CRUD), /admin/email-templates (CRUD), /admin/photos (moderation).
Public: /rares (+[category]), /leaderboard (credits/diamonds/duckets),
/guilds (+[id] members), /redeem (voucher -> sendCurrency).
Expanded: /u/[username] now shows badges + photos + guestbook (post form);
/news/[slug] now shows reactions + comments (comment form). Reactions tallied
in JS (Prisma groupBy typing avoided).
Self-hosted Nunito via next/font/google wired to --font-nunito (the atom theme
font, no runtime external fetch). Header + admin nav extended.

Verified: tsc exit 0, vitest 48/48, next build exit 0.

src/actions/guestbook.ts

@@ -0,0 +1,50 @@
+"use server";
+
+import { revalidatePath } from "next/cache";
+import { auth } from "@/lib/auth";
+import { prisma } from "@/lib/prisma";
+
+// Emulator/CMS column message is VARCHAR(255); keep the write within bounds.
+const MESSAGE_MAX = 255;
+
+/**
+ * Post a guestbook entry on a profile.
+ *
+ * The AUTHOR (userId) is re-read from the session via auth() and is never
+ * trusted from the submitted FormData, so a crafted form cannot impersonate
+ * another account. Only the PROFILE OWNER id (whose guestbook is written) is
+ * taken from the form, and we resolve a profile username from the form purely
+ * to revalidate the right page.
+ */
+export async function postGuestbook(formData: FormData): Promise<void> {
+  const session = await auth();
+  const userId = Number(session?.user?.id);
+  if (!Number.isInteger(userId) || userId <= 0) return;
+
+  const profileId = Number(formData.get("profileId"));
+  if (!Number.isInteger(profileId) || profileId <= 0) return;
+
+  const message = String(formData.get("message") ?? "").trim().slice(0, MESSAGE_MAX);
+  if (!message) return;
+
+  // Optional: used only to revalidate the correct profile route.
+  const username = String(formData.get("username") ?? "").trim();
+
+  const now = new Date();
+  try {
+    await prisma.websiteUserGuestbooks.create({
+      data: {
+        profileId,
+        userId,
+        message,
+        createdAt: now,
+        updatedAt: now,
+      },
+    });
+  } catch {
+    // DB unavailable — fail soft; nothing to persist.
+    return;
+  }
+
+  if (username) revalidatePath(`/u/${username}`);
+}