perf: cache search and news archive, drop motion/react from public pages

Closes the four remaining LOW items.

Search and news archive caching
- A leading-wildcard LIKE cannot use an index, so every /search section cost a
  COUNT(*) scan plus an ordered page fetch, and /news did the same for its
  archive. Both now cache: search per section for 30s, the archive for 60s
  under the existing news revision so publishing an article drops it at once.
- Sections are cached independently, so one slow query cannot hold up the rest
  and a failure is not cached as a result.
- The cached value is passed through cacheSafe() so the Redis path and the
  in-process path return the same types; without it a cache hit would hand the
  events grid a string where a miss hands it a Date, and it calls toISOString()
  on that field. Dates are revived on the way out so the public signatures of
  loadNewsArchive and loadPublicSearch are unchanged.
- Archive entries are keyed on the REQUESTED page rather than the clamped one,
  so two requests that clamp onto the same page cannot alias each other.

motion/react out of the public bundle
- Converted the six public-facing users: the radio player, the typewriter text
  (a motion.span with no animation props at all), the photo lightbox, the
  animated counter, the footer CMS-info popup and the scroll reveal. That was
  the actual entry points — the counter and the popup reach the public home page
  and footer through static imports, so removing only the three originally named
  would have left the library in the bundle anyway.
- Each animation moved to a CSS class, and the two that animate on exit now hold
  the element for the length of the fade, which is what AnimatePresence used to
  do.
- motion/react now only ships with /admin and the two already-lazy nav panels.
- Two safety fixes came out of this: the scroll reveal starts at opacity 0, so
  it is forced visible under prefers-reduced-motion and via a <noscript> rule in
  the root layout; and it now emits the .motion-reveal class, which the theme
  panel's "Scroll Reveal" toggle selects and which previously matched nothing.
- The CMS-info backdrop became a real button in a pointer-transparent layer
  instead of a handler on a static element, so click-outside-to-dismiss is
  reachable by keyboard.

Fewer duplicate router refreshes
- Next.js re-renders the current route as part of a server action's own response
  when that action revalidates, and applies it with a seeded navigation; the
  router only skips its own update when the action did NOT revalidate. So the
  refresh after such an action fetched the same tree twice.
- useServerAction takes an opt-in `revalidated` flag that skips it. It is opt-in
  per call rather than derived from an action name, since a rename would
  silently change behaviour. Applied to the two user-facing call sites whose
  actions were verified to revalidate their own route.

Touch targets
- .btn was the one shared control at 40px; it and the lightbox and CMS-info
  close buttons are now 44px, as is the password toggle (the auth input already
  reserved 44px for it). The remaining 32px icon buttons pass WCAG 2.2 AA, which
  only asks for 24px; enlarging those inside inputs and overlays was left alone
  because it risks visual breakage that cannot be checked from here.

src/hooks/use-server-action.test.ts

@@ -0,0 +1,58 @@
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { describe, expect, it } from "vitest";
+
+/**
+ * Contract test rather than a render test: the project runs Vitest in the node
+ * environment without a DOM or React testing library, so the refresh decision is
+ * asserted on the source. The behaviour it protects is a one-line branch, and
+ * the reasoning behind it (Next.js re-renders revalidating actions as part of
+ * the action response, so an explicit refresh is a duplicate round-trip) is
+ * documented at the option itself.
+ */
+const source = readFileSync(
+	resolve(process.cwd(), "src/hooks/use-server-action.ts"),
+	"utf8",
+);
+
+describe("useServerAction refresh handling", () => {
+	it("refreshes unless the caller marked the action as revalidating", () => {
+		expect(source).toMatch(/revalidated = false/);
+		expect(source).toMatch(/else if \(!revalidated\) router\.refresh\(\);/);
+	});
+
+	it("keeps refreshing on the default path", () => {
+		// The refresh must stay the fallback: an action that does not revalidate
+		// leaves the screen stale without it.
+		expect(source).not.toMatch(/router\.refresh\(\);\s*\}\s*else/);
+	});
+
+	it("documents why the refresh can be skipped", () => {
+		expect(source).toContain("revalidatePath");
+		expect(source).toContain("duplicate round-trip");
+	});
+
+	it("callers that opt in point at an action that revalidates", () => {
+		const files = [
+			"src/app/(site)/polls/[id]/poll-vote-form.tsx",
+			"src/app/(site)/events/[slugOrId]/event-register-button.tsx",
+		];
+		for (const file of files) {
+			const caller = readFileSync(resolve(process.cwd(), file), "utf8");
+			expect(caller).toContain("revalidated: true");
+		}
+
+		// …and the actions they name must actually revalidate their own route.
+		const polls = readFileSync(
+			resolve(process.cwd(), "src/actions/polls.ts"),
+			"utf8",
+		);
+		expect(polls).toContain('revalidatePath("/polls")');
+
+		const events = readFileSync(
+			resolve(process.cwd(), "src/actions/events.ts"),
+			"utf8",
+		);
+		expect(events).toContain('revalidatePath("/events")');
+	});
+});

src/hooks/use-server-action.ts

@@ -20,6 +20,21 @@ interface RunOptions {
 	onSuccess?: (data: Record<string, unknown>) => void;
 	/** Called when the action fails or throws */
 	onError?: () => void;
+	/**
+	 * Set only when the action calls `revalidatePath()` / `revalidateTag()` for
+	 * the route being displayed. Next.js then re-renders that page as part of the
+	 * action's own response and the router applies it with a seeded navigation,
+	 * so the extra `router.refresh()` is a duplicate round-trip.
+	 *
+	 * The framework only skips its own update when the action did NOT revalidate
+	 * and sent no flight data — see the bail-out in
+	 * `next/dist/client/components/router-reducer/reducers/server-action-reducer.js`.
+	 *
+	 * Leaving this off is always safe. Setting it for an action that does not
+	 * revalidate leaves the screen stale, so it is opt-in per call rather than
+	 * derived from the action name.
+	 */
+	revalidated?: boolean;
 }
 
 /**
@@ -52,6 +67,7 @@ export function useServerAction(options: UseServerActionOptions = {}) {
 			redirectTo,
 			onSuccess,
 			onError,
+			revalidated = false,
 		} = opts;
 
 		startTransition(async () => {
@@ -65,7 +81,10 @@ export function useServerAction(options: UseServerActionOptions = {}) {
 					} else {
 						const target = redirectTo || options.redirectOnSuccess;
 						if (target) router.push(target);
-						else router.refresh();
+						// The action already revalidated the current route, so its
+						// own response carried the new tree; refreshing again would
+						// just re-fetch it.
+						else if (!revalidated) router.refresh();
 					}
 				} else {
 					setFieldErrors(result.fieldErrors ?? {});