Add public REST API, anti-abuse protections, radio/GitHub cron jobs

Phase A — Public REST API (was the biggest gap). 20 JSON endpoints under
/api mirroring AtomCMS: users/[username], online(+/count), me, articles
(+/[slug]), photos, home, staff, teams, leaderboard, shop(+/categories),
values(+/categories), settings, radio/{config,now-playing,listeners,
shouts}. Shared src/lib/api.ts (apiJson — BigInt-safe + CORS, pagination).
Read-only, fail-soft, and field-safe (never exposes password/auth_ticket/
2FA secrets/mail).

Phase B — Anti-abuse on registration: CAPTCHA (Cloudflare Turnstile /
Google reCAPTCHA, settings-driven, widget rendered on the register page),
VPN/proxy detection (proxycheck.io / IPQualityScore via /admin/vpn
settings), and max-accounts-per-IP. All fail-open when unconfigured.
src/lib/services/{captcha,ip-lookup}.ts.

Phase C — jobs-worker cron suite: radio-record-songs (30s, logs track
changes to radio_song_plays), radio-auto-dj (rotates radio_auto_dj_playlist
when no live DJ), github-update-check (hourly, sets update_available).
Shared src/lib/services/radio.ts (now-playing/listeners parsing).

Verified live (prod, amx_test): /api/* return real JSON (leaderboard 6
users, settings carry no secrets, user endpoint hides password). tsc 0,
vitest 49/49, next build 0 (20 new API routes).

src/app/register/page.tsx

@@ -1,7 +1,11 @@
+import Script from "next/script";
 import Link from "next/link";
 import { getTranslations } from "next-intl/server";
 import { register } from "@/actions/register";
 import { ContentCard } from "@/components/public/ui";
+import { captchaConfig } from "@/lib/services/captcha";
+
+export const dynamic = "force-dynamic";
 
 export default async function RegisterPage({
   searchParams,
@@ -10,6 +14,8 @@ export default async function RegisterPage({
 }) {
   const t = await getTranslations("pages.register");
   const { error } = await searchParams;
+  const captcha = await captchaConfig();
+  const showCaptcha = captcha.provider !== "none" && !!captcha.siteKey;
 
   return (
     <main style={{ maxWidth: 420, margin: "2rem auto" }}>
@@ -28,10 +34,22 @@ export default async function RegisterPage({
             autoComplete="new-password"
             required
           />
+          {showCaptcha && captcha.provider === "turnstile" ? (
+            <div className="cf-turnstile" data-sitekey={captcha.siteKey} />
+          ) : null}
+          {showCaptcha && captcha.provider === "recaptcha" ? (
+            <div className="g-recaptcha" data-sitekey={captcha.siteKey} />
+          ) : null}
           <button type="submit" className="btn btn-primary">
             {t("register")}
           </button>
         </form>
+        {showCaptcha && captcha.provider === "turnstile" ? (
+          <Script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer />
+        ) : null}
+        {showCaptcha && captcha.provider === "recaptcha" ? (
+          <Script src="https://www.google.com/recaptcha/api.js" async defer />
+        ) : null}
         {error ? (
           <p style={{ color: "var(--color-danger)", textAlign: "center", marginBottom: 0 }}>
             {error}