Add production observability: Sentry, pino, and sharp badge encoding.

Sentry is opt-in via DSN env vars; logger uses structured pino JSON in prod; badge uploads are normalized to GIF with sharp.

Co-authored-by: Cursor <[email protected]>

src/actions/admin-badge-upload.ts

@@ -4,6 +4,7 @@ import { writeFile } from "node:fs/promises";
 import path from "node:path";
 import { redirect } from "next/navigation";
 import { requirePermission } from "@/lib/admin/guard";
+import { toBadgeGif } from "@/lib/images/badge-gif";
 import { PERMS } from "@/lib/permissions";
 import { logStaffActivity } from "@/lib/services/staff-activity";
 
@@ -52,15 +53,16 @@ export async function uploadBadge(formData: FormData): Promise<void> {
 
 	try {
 		const buffer = Buffer.from(await file.arrayBuffer());
+		const gif = await toBadgeGif(buffer);
 		const baseDir = path.resolve(dir);
 		const target = path.resolve(baseDir, `${code}.gif`);
 		if (!target.startsWith(baseDir + path.sep)) {
 			back("error", "Invalid path");
 		}
 		// eslint-disable-next-line security/detect-non-literal-fs-filename
-		await writeFile(target, buffer);
+		await writeFile(target, gif);
 	} catch {
-		back("error", "Could not write the badge file to disk");
+		back("error", "Could not process or write the badge file");
 	}
 
 	await logStaffActivity({