P1-P3 admin cleanup: rank guard, SSRF guard, count caching, dead code removal, pagination rewrite

- P1: new src/lib/admin/rank-guard.ts with tryGuardRank/guardRank + RankGuardTarget/Result; extracted from users.ts; applied to admin-bans (create/lift + rank redirect) and admin-badges (caps + rank guard + error surfacing); import-url-safety.ts SSRF guard wired into clone save+icon fetch; logAudit await in help-tickets; antiddos mutations SETTINGS_EDIT; markAllAlertsRead NOTIFICATIONS_EDIT; rankError/saveError in all 25 message files; tests rew/new for bans/badges/rank-guard/import-url-safety

- P2: ticket-inbox merged pagination reworked to single UNION ALL SQL with LIMIT/OFFSET (avoids O(offset) materialization); getCachedAdminCount with cacheFiltered option applied to devops/errors/photos/items/guilds/help-tickets/moderation pages; admin-theme catches→?error=1+banner+25 locales; logger in silent catches (rare-values/writeable-boxes); catalog-items-loader CAST→plain equality; count caching helper extended with opt-in cacheFiltered

- P3: removed dead modules is-staff/notice/recent-furni-resync/log-filters plus load-user-sanctions/user-sanction-timeline; removed orphaned CATALOG_PAGE_COLUMNS re-export; removed getFurniIconUrl from studio-furni-icons

Build: lint 0, typecheck 0, 3480 tests pass, i18n:check exit 0, colors exit 0. Circular chunk warning (9452/10535/66463) is webpack code-splitting artifact; build succeeds.

README.md

@@ -974,6 +974,13 @@ Every heavy command therefore runs inside its own cgroup with a hard
 `MemoryMax`, via `scripts/with-memory-cap.sh`. If the build outgrows its
 ceiling, only that cgroup is killed — the build fails, the site keeps serving.
 
+The systemd backend also sets `MemoryHigh` (95% of the ceiling) so the kernel
+reclaims and throttles **before** the hard limit, and it clamps the ceiling to
+`MemAvailable - reserve` (`CMS_MEMORY_CAP_RESERVE`, default `4g`). That stops a
+cap larger than the free memory from dragging the whole host into the global
+OOM-killer. `MemorySwapMax=0` is set explicitly (this host has no swap). If
+fewer than 1 GB would remain, the script refuses to start.
+
 | Script                | Ceiling | Covers                                  |
 | --------------------- | ------- | --------------------------------------- |
 | `pnpm dev`            | 8 GB    | Dev server                              |
@@ -1027,6 +1034,10 @@ where the container *is* the boundary (the Docker build, a CI runner), set
 On a host **without** systemd and without `CMS_MEMORY_CAP_BACKEND=none`, the
 script refuses to run rather than proceeding unbounded.
 
+Tunables for the systemd backend: `CMS_MEMORY_CAP_RESERVE` (default `4g`) is
+the headroom left for everything else on the machine; the effective ceiling is
+`min(requested, MemAvailable - reserve)`.
+
 > Do not "fix" a cap failure by lowering `--max-old-space-size` or by raising
 > `CMS_MEMORY_CAP_VIRTUAL` (the default is `40g` on purpose). A `ulimit -v` of
 > 10g makes V8 clamp its own heap to ~2.25 GB and webpack dies with