1.3.0: feat: Posts module, referral registration, sitemap

🗒️ Posts Module
Full CRUD for posts with revision history. Every update to a post creates a PostRevision snapshot preserving previous content, title, description, intro, status and signature.

Status lifecycle: draft → published → unpublished
Comments are implemented as child posts (parentId / rootId).

Validation: a validatePost query provides pre-flight checks with hard limits (title ≤ 512 chars, description ≤ 3072 chars) and SEO warnings.

AI guideline: a postGuidelines query returns a Markdown guide describing post structure and signing flow — useful for AI agents composing posts.

✍️ Post Signing (MetaMask)
Posts can be cryptographically signed to verify authorship:

Call getPostSignData(postId) — returns a canonical JSON message and a 5-minute server token.
Sign the message with your Ethereum private key (MetaMask).
Call signPost(postId, serverToken, userSignature) — server verifies both tokens and stores the signature.
Signature is invalidated on any subsequent post update.

🔐 Referral Registration
Registration now requires a referral token by default.

Existing users generate tokens via createReferrerToken mutation (JWT, default TTL: 1 hour).
Token can be delivered via URL: ?referrerToken=.
New users are linked to their referrer (referrerId field on User).
Bypass: MetaMask and Telegram auth skip the token requirement.
Set NEXT_PUBLIC_SITE_SIGNUP_STRATEGY=ANY to disable the requirement entirely.

👤 User Statuses
New newbie status added to UserStatus enum.

Status Create posts Comment Notes
active ✅ ✅ Full access
newbie ❌ ✅ Default for new users (configurable)
blocked ❌ ❌ Suspended
Set default status via USER_DEFAULT_STATUS env var.
Admin can toggle user status via new updateUser mutation (sudo only).

🗺️ Sitemap Generation
Automatic XML sitemaps:

/sitemap.xml — sitemap index
/sitemap/main.xml — main pages
/sitemap/posts.xml — published posts only
/sitemap/users.xml — active users only

🌱 Prisma Seed
A seed script now runs automatically on deploy (npm run prisma:seed).
Set SUDO_PASSWORD to create an admin user with full sudo access.

⚙️ Feature Flags
New environment variables to control which sections are enabled:

Variable Effect
NEXT_PUBLIC_POSTS_ENABLED Show/hide Posts in sidebar
NEXT_PUBLIC_WORLD3D_ENABLED Show/hide Metaverse in sidebar
NEXT_PUBLIC_CRYPTO_ENABLED Show/hide Balance, Transactions, Send Transfer
NEXT_PUBLIC_SITE_TITLE Global site title
NEXT_PUBLIC_MAIN_PAGE_TITLE Main page title

🛠️ Other Changes
JWT helper extracted to server/helpers/jwt.ts (removed code duplication across 3 files)
useBoolean hook — ergonomic boolean state with setTrue, setFalse, toggle
useCopy hook — clipboard copy with snackbar feedback
SeparatorStyled — flex spacer component
buildPostWhere / buildUserWhere — centralized query filtering with per-role visibility rules
Users page — added registration date, status badge, pagination
User profile — SEO noindex/nofollow for non-active users
SeoHeaders — always renders robots meta tag; description now accepts null
Telegram widget — conditionally rendered only when NEXT_PUBLIC_TELEGRAM_BOT_NAME is set