P1-P3 admin cleanup: rank guard, SSRF guard, count caching, dead code removal, pagination rewrite

- P1: new src/lib/admin/rank-guard.ts with tryGuardRank/guardRank + RankGuardTarget/Result; extracted from users.ts; applied to admin-bans (create/lift + rank redirect) and admin-badges (caps + rank guard + error surfacing); import-url-safety.ts SSRF guard wired into clone save+icon fetch; logAudit await in help-tickets; antiddos mutations SETTINGS_EDIT; markAllAlertsRead NOTIFICATIONS_EDIT; rankError/saveError in all 25 message files; tests rew/new for bans/badges/rank-guard/import-url-safety

- P2: ticket-inbox merged pagination reworked to single UNION ALL SQL with LIMIT/OFFSET (avoids O(offset) materialization); getCachedAdminCount with cacheFiltered option applied to devops/errors/photos/items/guilds/help-tickets/moderation pages; admin-theme catches→?error=1+banner+25 locales; logger in silent catches (rare-values/writeable-boxes); catalog-items-loader CAST→plain equality; count caching helper extended with opt-in cacheFiltered

- P3: removed dead modules is-staff/notice/recent-furni-resync/log-filters plus load-user-sanctions/user-sanction-timeline; removed orphaned CATALOG_PAGE_COLUMNS re-export; removed getFurniIconUrl from studio-furni-icons

Build: lint 0, typecheck 0, 3480 tests pass, i18n:check exit 0, colors exit 0. Circular chunk warning (9452/10535/66463) is webpack code-splitting artifact; build succeeds.

src/actions/admin-badges.ts

@@ -3,12 +3,18 @@
 import { and, eq, max } from "drizzle-orm";
 import { revalidatePath } from "next/cache";
 import { requirePermission } from "@/lib/admin/guard";
+import { tryGuardRank } from "@/lib/admin/rank-guard";
 import { db, UsersBadges } from "@/lib/db";
 import { PERMS } from "@/lib/permissions";
 import { rcon } from "@/lib/services/rcon";
 
+// Bound the bulk surface so a paste bomb cannot turn into an unbounded N+1.
+const MAX_USERS = 100;
+const MAX_CODES = 100;
+const MAX_PAIRS = 500;
+
 export async function giveBadge(formData: FormData): Promise<void> {
-	await requirePermission(PERMS.CATALOG_EDIT);
+	const staff = await requirePermission(PERMS.CATALOG_EDIT);
 
 	// Support comma-separated userIds and/or codes for bulk operations
 	const userIdInput = String(formData.get("userId") ?? "").trim();
@@ -18,30 +24,40 @@ export async function giveBadge(formData: FormData): Promise<void> {
 				.split(",")
 				.map((s) => s.trim())
 				.filter(Boolean)
+				.slice(0, MAX_USERS)
 		: [];
 	const codes = codeInput
 		? codeInput
 				.split(",")
 				.map((s) => s.trim())
 				.filter(Boolean)
+				.slice(0, MAX_CODES)
 		: [];
 
 	if (userIds.length === 0 || codes.length === 0) {
 		return;
 	}
 
-	// Process each user/code combination
-	let granted = false;
-	for (const userId of userIds) {
-		for (const code of codes) {
-			if (!(Number(userId) > 0) || code.length === 0) continue;
+	let granted = 0;
+	let failures = 0;
+	for (const rawUserId of userIds) {
+		const userId = Number(rawUserId);
+		if (!(userId > 0)) continue;
 
+		// Never hand badges to a target at or above the actor's rank.
+		const guard = await tryGuardRank(userId, staff.rank);
+		if (!guard.ok) continue;
+
+		for (const rawCode of codes) {
+			if (granted + failures >= MAX_PAIRS) break;
 			// Truncate badge code to 32 characters.
-			const truncatedCode = code.slice(0, 32);
+			const truncatedCode = rawCode.slice(0, 32);
+			if (truncatedCode.length === 0) continue;
 
 			// Fire the emulator command so the badge appears live for online users.
+			// Offline/unreachable emulator must not block the DB persistence.
 			try {
-				await rcon.giveBadge(Number(userId), truncatedCode);
+				await rcon.giveBadge(userId, truncatedCode);
 			} catch {
 				// ignore rcon errors per pair
 			}
@@ -55,7 +71,7 @@ export async function giveBadge(formData: FormData): Promise<void> {
 					.from(UsersBadges)
 					.where(
 						and(
-							eq(UsersBadges.userId, Number(userId)),
+							eq(UsersBadges.userId, userId),
 							eq(UsersBadges.badgeCode, truncatedCode),
 						),
 					)
@@ -64,23 +80,28 @@ export async function giveBadge(formData: FormData): Promise<void> {
 					const [agg] = await db
 						.select({ maxSlot: max(UsersBadges.slotId) })
 						.from(UsersBadges)
-						.where(eq(UsersBadges.userId, Number(userId)));
+						.where(eq(UsersBadges.userId, userId));
 					const slotId = (agg?.maxSlot ?? 0) + 1;
 					await db.insert(UsersBadges).values({
-						userId: Number(userId),
+						userId,
 						slotId,
 						badgeCode: truncatedCode,
 					});
+					granted++;
 				}
 			} catch {
-				// Best-effort: the RCON grant already succeeded for online users.
+				// A persistence failure must be visible, not silently dropped.
+				failures++;
 			}
-
-			granted = true;
 		}
 	}
 
-	if (granted) {
+	if (failures > 0) {
+		throw new Error(
+			`Failed to persist ${failures} badge grant(s); the emulator may have succeeded for some users`,
+		);
+	}
+	if (granted > 0) {
 		revalidatePath("/admin/badges");
 	}
 }