fix(cache): bound grace windows, cap render queues, and drop the useless estimate

Follow-up to f81b114b, addressing the three ways that commit could make things
worse rather than better. All three were verified against the real database or
by breaking the test and watching it fail.

- The grace window is now capped at 120s. A window is a cushion for the TTL
  boundary, not a second TTL, but the call sites treated it as the latter: the
  5 min values/staff routes and the 10 min teams route asked for a window as
  long as or longer than their own TTL, so a single large staleMs silently
  doubled how far behind a value could be served. Nothing marked those as
  unsafe, because nothing looked wrong. The cap lives in the cache rather than
  at the call sites so no future route can reintroduce it. Routes that asked
  for less than 120s (the 10s online poll, the 20s news cache) are unchanged,
  so their intended cushion still does its job.

- A request no longer queues behind an arbitrarily old render. Sharing a render
  is what collapses a cold-cache stampede into one render, but a hung render
  used to hold up everyone who arrived after it. A newcomer past 2s now serves
  the placeholder instead of waiting, reusing the ImagerUnavailableError path
  that "both upstreams down" already takes. The caller that actually started
  the render keeps waiting, which is correct: it is the one whose image this
  is. When the join window is removed the new test hangs for the full 10s it
  was meant to prevent, which is the tail this bounds.

- The information_schema row-count estimate is gone; the counters are exact
  again. Running it against the live database: users 165, rooms 92, camera_web
  0, and the estimate was 0.00% off on all three. At 165 rows an index scan is
  cheaper than the extra round trip the estimate needed, so the optimisation
  bought nothing and traded a guaranteed-correct member count for an
  approximation that InnoDB would only make less accurate as the table grows.
  The exactness is now pinned by tests: a real zero stays zero, a database
  error propagates instead of becoming a number, and each counter counts the
  table it claims to. The module stays, because the homepage and the boot
  warm-up writing different values to the same cache key is its own bug.

The module comment records the measured numbers, because "COUNT(*) is too slow"
sounds true in the abstract and is false here.

3223 tests pass.

src/lib/cache.ts

@@ -29,6 +29,14 @@ export interface CachedOptions {
 	staleMs?: number;
 }
 
+// Hard ceiling on the grace window. A window is a cushion for the TTL boundary,
+// not a second TTL: it exists so a mass expiry cannot block a request, and
+// keeping it short bounds how far behind a value can be served. Without a
+// ceiling a single large `staleMs` silently doubles the visible staleness of a
+// route (a 5 min TTL with a 5 min window serves data 10 min old), which is
+// exactly the kind of thing nobody notices until a support ticket.
+const MAX_STALE_MS = 120_000;
+
 const memory = new Map<string, CacheEntry>();
 
 function readPositiveInt(name: string, fallback: number): number {
@@ -148,7 +156,7 @@ export async function cached<T>(
 	fn: () => Promise<T>,
 	options: CachedOptions = {},
 ): Promise<T> {
-	const staleMs = Math.max(0, options.staleMs ?? 0);
+	const staleMs = Math.min(Math.max(0, options.staleMs ?? 0), MAX_STALE_MS);
 	// `existing &&` short-circuits so Date.now() is never evaluated during
 	// prerender when the map is empty (keeps `next build` prerendering clean).
 	const existing = getMemory(key);