P1-P3 admin cleanup: rank guard, SSRF guard, count caching, dead code removal, pagination rewrite

- P1: new src/lib/admin/rank-guard.ts with tryGuardRank/guardRank + RankGuardTarget/Result; extracted from users.ts; applied to admin-bans (create/lift + rank redirect) and admin-badges (caps + rank guard + error surfacing); import-url-safety.ts SSRF guard wired into clone save+icon fetch; logAudit await in help-tickets; antiddos mutations SETTINGS_EDIT; markAllAlertsRead NOTIFICATIONS_EDIT; rankError/saveError in all 25 message files; tests rew/new for bans/badges/rank-guard/import-url-safety

- P2: ticket-inbox merged pagination reworked to single UNION ALL SQL with LIMIT/OFFSET (avoids O(offset) materialization); getCachedAdminCount with cacheFiltered option applied to devops/errors/photos/items/guilds/help-tickets/moderation pages; admin-theme catches→?error=1+banner+25 locales; logger in silent catches (rare-values/writeable-boxes); catalog-items-loader CAST→plain equality; count caching helper extended with opt-in cacheFiltered

- P3: removed dead modules is-staff/notice/recent-furni-resync/log-filters plus load-user-sanctions/user-sanction-timeline; removed orphaned CATALOG_PAGE_COLUMNS re-export; removed getFurniIconUrl from studio-furni-icons

Build: lint 0, typecheck 0, 3480 tests pass, i18n:check exit 0, colors exit 0. Circular chunk warning (9452/10535/66463) is webpack code-splitting artifact; build succeeds.

src/actions/admin-bans.test.ts

@@ -22,7 +22,7 @@ vi.mock("@/lib/auth", () => ({
 	signOut: vi.fn(),
 }));
 
-import { Ban, db, User } from "@/lib/db";
+import { Ban, db } from "@/lib/db";
 import { PERMS } from "@/lib/permissions";
 import { createBan, liftBan } from "./admin-bans";
 
@@ -42,6 +42,20 @@ vi.mock("@/lib/admin/guard", () => ({
 	requirePermissionRateLimited: mockRequirePermissionRateLimited,
 }));
 
+const mockTryGuardRank = vi.hoisted(() => vi.fn());
+vi.mock("@/lib/admin/rank-guard", () => ({
+	tryGuardRank: mockTryGuardRank,
+}));
+
+const mockRedirect = vi.hoisted(() =>
+	vi.fn(() => {
+		throw new Error("NEXT_REDIRECT");
+	}),
+);
+vi.mock("next/navigation", () => ({
+	redirect: mockRedirect,
+}));
+
 // Hoisted mocks for internal db functions
 const hoistedInsertValues = vi.hoisted(() => vi.fn());
 const hoistedDeleteWhere = vi.hoisted(() => vi.fn());
@@ -61,7 +75,6 @@ vi.mock("@/lib/db", () => {
 			select: vi.fn(() => ({ from: hoistedSelectFrom })),
 		},
 		Ban: { id: "Ban.id", userId: "Ban.userId" },
-		User: { id: "User.id", username: "User.username" },
 	};
 });
 
@@ -93,7 +106,11 @@ beforeEach(() => {
 	mockRequirePermissionRateLimited.mockResolvedValue({ id: 100, rank: 7 });
 	hoistedInsertValues.mockResolvedValue([{ insertId: 1 }]);
 	hoistedDeleteWhere.mockResolvedValue([{ affectedRows: 1 }]);
-	hoistedSelectLimit.mockResolvedValue([{ username: "testuser" }]);
+	hoistedSelectLimit.mockResolvedValue([{ userId: 5 }]);
+	mockTryGuardRank.mockResolvedValue({
+		ok: true,
+		target: { username: "testuser", rank: 1, mail: null },
+	});
 	mockHeaders.mockReturnValue(new Map());
 });
 
@@ -110,6 +127,7 @@ describe("createBan", () => {
 		expect(mockRequirePermissionRateLimited).toHaveBeenCalledWith(
 			PERMS.USERS_BAN,
 		);
+		expect(mockTryGuardRank).toHaveBeenCalledWith(1, 7);
 		expect(db.insert).toHaveBeenCalledWith(Ban);
 		expect(hoistedInsertValues).toHaveBeenCalledWith(
 			expect.objectContaining({
@@ -156,6 +174,7 @@ describe("createBan", () => {
 
 		await createBan(formData);
 
+		expect(mockTryGuardRank).not.toHaveBeenCalled();
 		expect(db.insert).not.toHaveBeenCalled();
 		expect(mockLogStaffActivity).not.toHaveBeenCalled();
 	});
@@ -169,27 +188,45 @@ describe("createBan", () => {
 
 		await createBan(formData);
 
+		expect(mockTryGuardRank).not.toHaveBeenCalled();
 		expect(db.insert).not.toHaveBeenCalled();
 		expect(mockLogStaffActivity).not.toHaveBeenCalled();
 	});
 
-	it("disconnects user via RCON if user found", async () => {
+	it("disconnects user via RCON using the guarded username", async () => {
+		mockTryGuardRank.mockResolvedValueOnce({
+			ok: true,
+			target: { username: "anotheruser", rank: 1, mail: null },
+		});
 		const formData = new FormData();
 		formData.append("userId", "3");
 		formData.append("type", "account");
 		formData.append("reason", "Test reason");
 
-		hoistedSelectLimit.mockResolvedValueOnce([{ username: "anotheruser" }]);
-
 		await createBan(formData);
 
+		expect(mockTryGuardRank).toHaveBeenCalledWith(3, 7);
 		expect(mockRconDisconnectUser).toHaveBeenCalledWith(3, "anotheruser");
-		expect(mockEq).toHaveBeenCalledWith(User.id, 3);
+	});
+
+	it("refuses to ban a user with equal or higher rank", async () => {
+		mockTryGuardRank.mockResolvedValueOnce({ ok: false, reason: "rank" });
+		const formData = new FormData();
+		formData.append("userId", "3");
+		formData.append("type", "account");
+		formData.append("reason", "Test reason");
+
+		await expect(createBan(formData)).rejects.toThrow("NEXT_REDIRECT");
+
+		expect(mockRedirect).toHaveBeenCalledWith("/admin/bans?error=rank");
+		expect(db.insert).not.toHaveBeenCalled();
+		expect(mockLogStaffActivity).not.toHaveBeenCalled();
 	});
 });
 
 describe("liftBan", () => {
 	it("lifts an existing ban and logs activity", async () => {
+		hoistedSelectLimit.mockResolvedValueOnce([{ userId: 5 }]);
 		const formData = new FormData();
 		formData.append("id", "123");
 
@@ -198,6 +235,8 @@ describe("liftBan", () => {
 		expect(mockRequirePermissionRateLimited).toHaveBeenCalledWith(
 			PERMS.USERS_BAN,
 		);
+		expect(mockEq).toHaveBeenCalledWith(Ban.id, 123);
+		expect(mockTryGuardRank).toHaveBeenCalledWith(5, 7);
 		expect(db.delete).toHaveBeenCalledWith(Ban);
 		expect(hoistedDeleteWhere).toHaveBeenCalledWith(mockEq(Ban.id, 123));
 		expect(mockLogStaffActivity).toHaveBeenCalledWith(
@@ -209,12 +248,37 @@ describe("liftBan", () => {
 		expect(mockRevalidatePath).toHaveBeenCalledWith("/admin/bans");
 	});
 
+	it("refuses to lift a ban placed on an equal or higher rank user", async () => {
+		hoistedSelectLimit.mockResolvedValueOnce([{ userId: 5 }]);
+		mockTryGuardRank.mockResolvedValueOnce({ ok: false, reason: "rank" });
+		const formData = new FormData();
+		formData.append("id", "123");
+
+		await expect(liftBan(formData)).rejects.toThrow("NEXT_REDIRECT");
+
+		expect(mockRedirect).toHaveBeenCalledWith("/admin/bans?error=rank");
+		expect(hoistedDeleteWhere).not.toHaveBeenCalled();
+		expect(mockLogStaffActivity).not.toHaveBeenCalled();
+	});
+
+	it("tolerates a lift when the targeted user no longer exists", async () => {
+		hoistedSelectLimit.mockResolvedValueOnce([{ userId: 5 }]);
+		mockTryGuardRank.mockResolvedValueOnce({ ok: false, reason: "not_found" });
+		const formData = new FormData();
+		formData.append("id", "123");
+
+		await liftBan(formData);
+
+		expect(db.delete).toHaveBeenCalledWith(Ban);
+	});
+
 	it("does not delete if ban id is not positive", async () => {
 		const formData = new FormData();
 		formData.append("id", "0");
 
 		await liftBan(formData);
 
+		expect(mockEq).not.toHaveBeenCalled();
 		expect(db.delete).not.toHaveBeenCalled();
 		expect(hoistedDeleteWhere).not.toHaveBeenCalled();
 		expect(mockLogStaffActivity).not.toHaveBeenCalled();