P1-P3 admin cleanup: rank guard, SSRF guard, count caching, dead code removal, pagination rewrite

- P1: new src/lib/admin/rank-guard.ts with tryGuardRank/guardRank + RankGuardTarget/Result; extracted from users.ts; applied to admin-bans (create/lift + rank redirect) and admin-badges (caps + rank guard + error surfacing); import-url-safety.ts SSRF guard wired into clone save+icon fetch; logAudit await in help-tickets; antiddos mutations SETTINGS_EDIT; markAllAlertsRead NOTIFICATIONS_EDIT; rankError/saveError in all 25 message files; tests rew/new for bans/badges/rank-guard/import-url-safety

- P2: ticket-inbox merged pagination reworked to single UNION ALL SQL with LIMIT/OFFSET (avoids O(offset) materialization); getCachedAdminCount with cacheFiltered option applied to devops/errors/photos/items/guilds/help-tickets/moderation pages; admin-theme catches→?error=1+banner+25 locales; logger in silent catches (rare-values/writeable-boxes); catalog-items-loader CAST→plain equality; count caching helper extended with opt-in cacheFiltered

- P3: removed dead modules is-staff/notice/recent-furni-resync/log-filters plus load-user-sanctions/user-sanction-timeline; removed orphaned CATALOG_PAGE_COLUMNS re-export; removed getFurniIconUrl from studio-furni-icons

Build: lint 0, typecheck 0, 3480 tests pass, i18n:check exit 0, colors exit 0. Circular chunk warning (9452/10535/66463) is webpack code-splitting artifact; build succeeds.

src/actions/admin-badges.test.ts

@@ -8,12 +8,16 @@ const state = vi.hoisted(() => ({
 	fail: false,
 	giveBadge: vi.fn(async () => undefined),
 	requirePermission: vi.fn(),
+	tryGuardRank: vi.fn(),
 	revalidatePath: vi.fn(),
 }));
 
 vi.mock("@/lib/admin/guard", () => ({
 	requirePermission: state.requirePermission,
 }));
+vi.mock("@/lib/admin/rank-guard", () => ({
+	tryGuardRank: state.tryGuardRank,
+}));
 vi.mock("@/lib/permissions", () => ({
 	PERMS: { CATALOG_EDIT: "admin.catalog.edit" },
 }));
@@ -55,6 +59,10 @@ beforeEach(() => {
 	state.insertValues.mockResolvedValue([{}]);
 	state.giveBadge.mockResolvedValue(undefined);
 	state.requirePermission.mockResolvedValue({ id: 1, rank: 7, username: "a" });
+	state.tryGuardRank.mockResolvedValue({
+		ok: true,
+		target: { username: "u", rank: 1, mail: null },
+	});
 });
 
 describe("giveBadge", () => {
@@ -64,6 +72,7 @@ describe("giveBadge", () => {
 		await giveBadge(form("3", "ACH_Test"));
 
 		expect(state.requirePermission).toHaveBeenCalledWith(PERMS.CATALOG_EDIT);
+		expect(state.tryGuardRank).toHaveBeenCalledWith(3, 7);
 		expect(state.giveBadge).toHaveBeenCalledWith(3, "ACH_Test");
 		expect(state.insertValues).toHaveBeenCalledWith({
 			userId: 3,
@@ -97,19 +106,42 @@ describe("giveBadge", () => {
 		});
 	});
 
-	it("does not persist a duplicate badge", async () => {
+	it("does not persist a duplicate badge and skips revalidation", async () => {
 		state.existingRows = [{ id: 10 }];
 
 		await giveBadge(form("4", "DUP"));
 
 		expect(state.giveBadge).toHaveBeenCalledWith(4, "DUP");
 		expect(state.insertValues).not.toHaveBeenCalled();
-		expect(state.revalidatePath).toHaveBeenCalledWith("/admin/badges");
+		expect(state.revalidatePath).not.toHaveBeenCalled();
+	});
+
+	it("skips a user at or above the actor rank", async () => {
+		state.tryGuardRank.mockResolvedValueOnce({ ok: false, reason: "rank" });
+
+		await giveBadge(form("4", "DUP"));
+
+		expect(state.giveBadge).not.toHaveBeenCalled();
+		expect(state.insertValues).not.toHaveBeenCalled();
+		expect(state.revalidatePath).not.toHaveBeenCalled();
+	});
+
+	it("skips an unknown user", async () => {
+		state.tryGuardRank.mockResolvedValueOnce({
+			ok: false,
+			reason: "not_found",
+		});
+
+		await giveBadge(form("404", "DUP"));
+
+		expect(state.giveBadge).not.toHaveBeenCalled();
+		expect(state.insertValues).not.toHaveBeenCalled();
 	});
 
 	it("returns early for a non-positive user id", async () => {
 		await giveBadge(form("0", "X"));
 
+		expect(state.tryGuardRank).not.toHaveBeenCalled();
 		expect(state.giveBadge).not.toHaveBeenCalled();
 		expect(state.insertValues).not.toHaveBeenCalled();
 		expect(state.revalidatePath).not.toHaveBeenCalled();
@@ -138,21 +170,36 @@ describe("giveBadge", () => {
 		expect(state.giveBadge).toHaveBeenCalledWith(5, "a".repeat(32));
 	});
 
-	it("swallows persistence failures after the rcon grant", async () => {
-		state.insertValues.mockRejectedValueOnce(new Error("db down"));
+	it("caps bulk user and code lists", async () => {
+		const users = Array.from({ length: 250 }, (_, i) => i + 1).join(",");
+		const codes = Array.from({ length: 250 }, (_, i) => `C${i}`).join(",");
 
-		await expect(giveBadge(form("6", "BEST"))).resolves.toBeUndefined();
+		await giveBadge(form(users, codes));
 
-		expect(state.giveBadge).toHaveBeenCalledWith(6, "BEST");
-		expect(state.revalidatePath).toHaveBeenCalledWith("/admin/badges");
+		// 100 users x 100 codes = 10k pairs, capped to MAX_PAIRS (500).
+		const calls = state.insertValues.mock.calls.length;
+		expect(calls).toBeLessThanOrEqual(500);
 	});
 
-	it("swallows select failures and still revalidates", async () => {
+	it("throws when persistence fails instead of swallowing it", async () => {
+		state.insertValues.mockRejectedValueOnce(new Error("db down"));
+
+		await expect(giveBadge(form("6", "BEST"))).rejects.toThrow(
+			"Failed to persist",
+		);
+
+		expect(state.giveBadge).toHaveBeenCalledWith(6, "BEST");
+		expect(state.revalidatePath).not.toHaveBeenCalled();
+	});
+
+	it("throws when the select fails instead of reporting a false success", async () => {
 		state.fail = true;
 
-		await expect(giveBadge(form("6", "BEST"))).resolves.toBeUndefined();
+		await expect(giveBadge(form("6", "BEST"))).rejects.toThrow(
+			"Failed to persist",
+		);
 
-		expect(state.revalidatePath).toHaveBeenCalledWith("/admin/badges");
+		expect(state.revalidatePath).not.toHaveBeenCalled();
 	});
 
 	it("propagates a permission denial", async () => {