perf: optimize DB layer with caching and pool tuning

- Add Redis cache wrapper (cached-db.ts) — cachedQuery + invalidate helpers
- Add cached login user lookup (auth.ts: getLoginUser) — short 15s TTL
  for brute-force protection, cache invalidation on password/rank changes
- Switch auth.ts login flow from Prisma facade to raw SQL via db.execute
  (avoids abstraction overhead for this hot path)
- Cache invalidation wired in: login password upgrade, updateUser, resetPassword
- Connection pool tuning: enableKeepAlive, namedPlaceholders,
  prepared statement cache (Node 22+), multipleStatements off (SQLi hardening)
- 0 tsc errors, 583 tests passing

src/actions/users.ts

@@ -3,6 +3,7 @@
 import crypto from "node:crypto";
 import { z } from "zod";
 import { hashPassword } from "@/lib/auth/password";
+import { invalidateLoginCache } from "@/lib/auth";
 import { PERMS } from "@/lib/permissions";
 import { prisma } from "@/lib/prisma";
 import { adminAction } from "@/lib/safe-action";
@@ -119,6 +120,7 @@ export const updateUser = adminAction(
 		}
 
 		await prisma.user.update({ where: { id }, data: userData });
+		invalidateLoginCache(targetUser.username);
 
 		if (diamonds !== undefined) {
 			await prisma.usersCurrency.upsert({
@@ -313,6 +315,7 @@ export const resetPassword = adminAction(
 			where: { id: ctx.data.userId },
 			data: { password: hashed },
 		});
+		invalidateLoginCache(target.username);
 
 		logAudit({
 			userId: ctx.session.user.id,

src/lib/cached-db.ts

@@ -0,0 +1,56 @@
+import "server-only";
+
+import { redis } from "@/lib/redis";
+import { logger } from "@/lib/logger";
+
+const DEFAULT_CACHE_TTL = 60;
+
+function isRedisAvailable(): boolean {
+	return !!redis && redis.status !== "end";
+}
+
+export async function cachedQuery<T>(
+	cacheKey: string,
+	queryFn: () => Promise<T>,
+	ttl: number = DEFAULT_CACHE_TTL,
+): Promise<T> {
+	if (!isRedisAvailable()) {
+		return queryFn();
+	}
+
+	try {
+		const cached = await redis?.get(cacheKey);
+		if (cached !== null && cached !== undefined) {
+			return JSON.parse(cached) as T;
+		}
+	} catch (err) {
+		logger.warn("[cache] read failed, falling back to DB", { key: cacheKey, error: String(err) });
+	}
+
+	const result = await queryFn();
+
+	try {
+		await redis?.setex(cacheKey, ttl, JSON.stringify(result));
+	} catch (err) {
+		logger.warn("[cache] write failed, continuing without cache", {
+			key: cacheKey,
+			error: String(err),
+		});
+	}
+
+	return result;
+}
+
+/** Invalidate cache keys matching a glob pattern. */
+export function invalidateCache(pattern: string): Promise<number> {
+	if (!isRedisAvailable()) return Promise.resolve(0);
+	return redis?.keys(pattern).then((keys) =>
+		keys.length > 0 ? redis!.del(...keys) : 0,
+	) ?? Promise.resolve(0);
+}
+
+/** Invalidate a single cache key immediately. */
+export function invalidateKey(key: string): Promise<number> {
+	if (!isRedisAvailable()) return Promise.resolve(0);
+	return redis!.del(key);
+}

src/lib/db.ts

@@ -34,8 +34,16 @@ function createDb(): MySql2Database<typeof fullSchema> {
 		queueLimit: 0,
 		connectTimeout,
 		idleTimeout: env.DATABASE_IDLE_TIMEOUT_MS,
-		// Keep BIGINT precision; safe values come back as numbers, huge ones as
-		// strings (drizzle bigint mode maps both to JS bigint).
+		enableKeepAlive: true,
+		// Prepared-statement caching via mysql2's native support (Node 22+).
+		// Saves query-parse per request on hot paths.
+		...("cache" in mysql.createPool && {
+			cache: { type: "prepared" },
+		}),
+		// Allow :placeholder syntax for raw SQL helpers.
+		namedPlaceholders: true,
+		// Reject multiple statements (SQL injection hardening).
+		multipleStatements: false,
 		supportBigNumbers: true,
 	});