2 Commits

Include renames

Author	SHA1	Message	Date
Simo	6f15e0c8a3	Production hardening: error pages, rate limiting, metadata ... - Custom not-found (404) + error / global-error boundaries, styled with the public design system; raw errors logged, never shown to users. - In-process rate limiter (src/lib/rate-limit.ts) wired into the abuse- prone flows: login (10/5min/IP), register (5/10min/IP), password-reset request (3/15min/IP), keyed by the proxy-forwarded client IP. - SEO/metadata: root generateMetadata sets a `%s · {hotel}` title template from the live hotel_name; dynamic generateMetadata on news/[slug] (article title + excerpt) and u/[username] (name + motto); static titles on 12 primary public pages. - env.ts: added the vars introduced since (PASSWORD_HASH, OPENAI_API_KEY, DISCORD_WEBHOOK_URL, ALERT_EMAIL, PAYPAL_*) so env stays authoritative. Verified on the prod server: /missing → 404 card, news title renders "News · Habbo". tsc 0, vitest 49/49, next build 0.	2026-06-28 20:12:12 +02:00
Simo	e668fa85ec	Add 2FA, email + password reset, and batch-7 pages ... Auth (hand-built on the auth core): - 2FA: User model gains two_factor_secret/recovery_codes/confirmed_at (+ idempotent MariaDB migration). authorize() requires a valid TOTP code when 2FA is confirmed (secret decrypted via Laravel APP_KEY, fail-closed). Two-step login (precheckLogin reveals the code field). /settings/2fa enable/confirm/disable flow. - Password reset: nodemailer email service; PasswordReset model + migration; /forgot (request, generic response) + /reset (token sha256 + 1h TTL, sets argon2id hash). Login links to forgot. Batch 7 (parallel agents): /admin/commandocentrum (RCON controls + emulator_errors), social write actions (friend request + guild forum new thread), /help/[category], /badges (public). env: APP_KEY, APP_URL, SMTP_*. Nav extended. Verified: tsc exit 0, vitest 48/48, next build exit 0 (64 page routes).	2026-06-28 14:25:19 +02:00