Add security middleware, audit log, alerts, PayPal, cron, radio + apps

Security (launch blockers):
- src/middleware.ts (edge): forwards x-pathname + real client IP.
- access-guard.ts (Node, from root layout): routes non-staff to /maintenance
  when maintenance mode is on, banned users to /banned. New /banned + /maintenance
  pages (the consumers the admin toggle was missing). Admin layout enforces
  force_staff_2fa before /admin.
- staff-activity.ts audit log wired into ban/lift/give-currency/set-rank actions.

Infra (parallel agents): alert service (alert_logs + Discord embed + email),
PayPal top-up (create/capture API routes + /shop/topup), cron worker
(scripts/jobs-worker.ts via croner: emulator-ping->alert, maintenance-check,
bans-cleanup), social connections page, admin radio settings/banners/ranks.
Public radio subsystem: /radio (+schedule, shouts+post, contests, giveaways,
apply, leaderboard) and /apply/staff + /apply/team submission forms. Radio nav
link added. .env.example documents the new optional vars.

(radio song-requests dropped: its table is a stub in AtomCMS — columns added by
un-modeled alter-migrations.)

Verified: tsc exit 0, vitest 48/48, next build exit 0 (82 page routes).

src/app/radio/apply/page.tsx

@@ -0,0 +1,145 @@
+import { redirect } from "next/navigation";
+import { auth } from "@/lib/auth";
+import { prisma } from "@/lib/prisma";
+import { applyDj } from "@/actions/radio-apply";
+
+export const dynamic = "force-dynamic";
+
+export default async function RadioApplyPage() {
+  const session = await auth();
+  if (!session?.user?.id) redirect("/login");
+
+  const userId = Number(session.user.id);
+
+  // Surface the applicant's most recent application (if any) so they aren't
+  // left guessing. Isolated query: a DB hiccup degrades this to null, not 500.
+  const existing = await prisma.radioApplications
+    .findFirst({
+      where: { userId: BigInt(userId) },
+      orderBy: { id: "desc" },
+      select: { id: true, status: true, createdAt: true },
+    })
+    .catch(() => null);
+
+  const submittedDate = existing?.createdAt
+    ? existing.createdAt.toISOString().slice(0, 10)
+    : null;
+
+  return (
+    <main>
+      <div className="hero">
+        <h1 style={{ margin: "0 0 0.25rem" }}>Apply to be a Radio DJ</h1>
+        <p className="muted" style={{ margin: 0 }}>
+          Tell us about yourself and why you&apos;d be a great fit for the airwaves.
+        </p>
+      </div>
+
+      {existing ? (
+        <div className="card" style={{ marginBottom: "1.25rem" }}>
+          <p style={{ margin: 0 }}>
+            <strong>Your latest application:</strong> {existing.status}
+            {submittedDate ? (
+              <span className="muted"> · submitted {submittedDate}</span>
+            ) : null}
+          </p>
+          <p className="muted" style={{ margin: "0.4rem 0 0" }}>
+            You can submit again below if your details have changed.
+          </p>
+        </div>
+      ) : null}
+
+      <form action={applyDj} className="card">
+        <div className="grid cols-2">
+          <div>
+            <label htmlFor="realName" className="muted">
+              Real name
+            </label>
+            <input
+              id="realName"
+              name="realName"
+              type="text"
+              required
+              maxLength={255}
+              placeholder="Your full name"
+              style={{ width: "100%", marginTop: "0.3rem" }}
+            />
+          </div>
+          <div>
+            <label htmlFor="age" className="muted">
+              Age
+            </label>
+            <input
+              id="age"
+              name="age"
+              type="number"
+              required
+              min={13}
+              max={120}
+              placeholder="18"
+              style={{ width: "100%", marginTop: "0.3rem" }}
+            />
+          </div>
+        </div>
+
+        <div style={{ marginTop: "1rem" }}>
+          <label htmlFor="availability" className="muted">
+            Availability
+          </label>
+          <textarea
+            id="availability"
+            name="availability"
+            required
+            rows={3}
+            placeholder="Which days and times can you broadcast?"
+            style={{ width: "100%", marginTop: "0.3rem", resize: "vertical" }}
+          />
+        </div>
+
+        <div style={{ marginTop: "1rem" }}>
+          <label htmlFor="musicStyle" className="muted">
+            Music style
+          </label>
+          <input
+            id="musicStyle"
+            name="musicStyle"
+            type="text"
+            maxLength={255}
+            placeholder="e.g. House, Pop, Hip-Hop"
+            style={{ width: "100%", marginTop: "0.3rem" }}
+          />
+        </div>
+
+        <div style={{ marginTop: "1rem" }}>
+          <label htmlFor="experience" className="muted">
+            Experience <span className="muted">(optional)</span>
+          </label>
+          <textarea
+            id="experience"
+            name="experience"
+            rows={3}
+            placeholder="Any prior DJ or hosting experience?"
+            style={{ width: "100%", marginTop: "0.3rem", resize: "vertical" }}
+          />
+        </div>
+
+        <div style={{ marginTop: "1rem" }}>
+          <label htmlFor="motivation" className="muted">
+            Motivation
+          </label>
+          <textarea
+            id="motivation"
+            name="motivation"
+            required
+            rows={4}
+            placeholder="Why do you want to join the radio team?"
+            style={{ width: "100%", marginTop: "0.3rem", resize: "vertical" }}
+          />
+        </div>
+
+        <button type="submit" className="btn btn-primary" style={{ marginTop: "1.25rem" }}>
+          Submit application
+        </button>
+      </form>
+    </main>
+  );
+}