Add support page, admin features, and auth hardening.

Rename public affiliate route to /support with localized nav labels, and include affiliate/social/wallpaper admin, 2FA login, and related site updates.

Co-authored-by: Cursor <cursoragent@cursor.com>

database/add-2fa.sql

@@ -0,0 +1,8 @@
+IF COL_LENGTH('dbo.admins', 'two_factor_enabled') IS NULL
+BEGIN
+    ALTER TABLE dbo.admins ADD two_factor_enabled BIT NOT NULL CONSTRAINT DF_admins_two_factor_enabled DEFAULT(0);
+END
+IF COL_LENGTH('dbo.admins', 'two_factor_secret') IS NULL
+BEGIN
+    ALTER TABLE dbo.admins ADD two_factor_secret NVARCHAR(64) NULL;
+END

database/harden-auth.sql

@@ -0,0 +1,24 @@
+IF COL_LENGTH('dbo.admins', 'two_factor_secret') IS NOT NULL
+BEGIN
+    ALTER TABLE dbo.admins ALTER COLUMN two_factor_secret NVARCHAR(512) NULL;
+END
+IF COL_LENGTH('dbo.admins', 'password') IS NOT NULL
+BEGIN
+    ALTER TABLE dbo.admins ALTER COLUMN password NVARCHAR(255) NOT NULL;
+END
+IF COL_LENGTH('dbo.admins', 'login_failed_count') IS NULL
+BEGIN
+    ALTER TABLE dbo.admins ADD login_failed_count INT NOT NULL CONSTRAINT DF_admins_login_failed_count DEFAULT(0);
+END
+IF COL_LENGTH('dbo.admins', 'login_lock_until') IS NULL
+BEGIN
+    ALTER TABLE dbo.admins ADD login_lock_until DATETIME2 NULL;
+END
+IF COL_LENGTH('dbo.admins', 'totp_failed_count') IS NULL
+BEGIN
+    ALTER TABLE dbo.admins ADD totp_failed_count INT NOT NULL CONSTRAINT DF_admins_totp_failed_count DEFAULT(0);
+END
+IF COL_LENGTH('dbo.admins', 'totp_lock_until') IS NULL
+BEGIN
+    ALTER TABLE dbo.admins ADD totp_lock_until DATETIME2 NULL;
+END