P1-P3 admin cleanup: rank guard, SSRF guard, count caching, dead code removal, pagination rewrite

- P1: new src/lib/admin/rank-guard.ts with tryGuardRank/guardRank + RankGuardTarget/Result; extracted from users.ts; applied to admin-bans (create/lift + rank redirect) and admin-badges (caps + rank guard + error surfacing); import-url-safety.ts SSRF guard wired into clone save+icon fetch; logAudit await in help-tickets; antiddos mutations SETTINGS_EDIT; markAllAlertsRead NOTIFICATIONS_EDIT; rankError/saveError in all 25 message files; tests rew/new for bans/badges/rank-guard/import-url-safety

- P2: ticket-inbox merged pagination reworked to single UNION ALL SQL with LIMIT/OFFSET (avoids O(offset) materialization); getCachedAdminCount with cacheFiltered option applied to devops/errors/photos/items/guilds/help-tickets/moderation pages; admin-theme catches→?error=1+banner+25 locales; logger in silent catches (rare-values/writeable-boxes); catalog-items-loader CAST→plain equality; count caching helper extended with opt-in cacheFiltered

- P3: removed dead modules is-staff/notice/recent-furni-resync/log-filters plus load-user-sanctions/user-sanction-timeline; removed orphaned CATALOG_PAGE_COLUMNS re-export; removed getFurniIconUrl from studio-furni-icons

Build: lint 0, typecheck 0, 3480 tests pass, i18n:check exit 0, colors exit 0. Circular chunk warning (9452/10535/66463) is webpack code-splitting artifact; build succeeds.

src/app/api/admin/import/clone/icon/route.ts

@@ -1,5 +1,6 @@
 import { apiError } from "@/lib/api";
 import { withAdmin } from "@/lib/api-handler";
+import { assertSafeImportUrl } from "@/lib/import-url-safety";
 import { PERMS } from "@/lib/permissions";
 import { extractFurniIconPng } from "@/lib/services/clone-icon";
 import { getSource } from "@/lib/services/clone-sources";
@@ -38,10 +39,20 @@ export const GET = withAdmin(
 		if (icon === undefined) {
 			const source = await getSource(sourceId);
 			if (!source) return apiError("Source not found", 404);
+			if (!source.nitroBaseUrl)
+				return apiError("Source has no nitro base URL", 400);
 			try {
-				const res = await fetch(`${source.nitroBaseUrl}/${classname}.nitro`, {
-					signal: AbortSignal.timeout(15000),
-				});
+				await assertSafeImportUrl(source.nitroBaseUrl, "nitroBaseUrl");
+			} catch (err) {
+				return apiError((err as Error).message, 400);
+			}
+			try {
+				const res = await fetch(
+					`${source.nitroBaseUrl.replace(/\/+$/, "")}/${classname}.nitro`,
+					{
+						signal: AbortSignal.timeout(15000),
+					},
+				);
 				if (!res.ok) {
 					iconCache.set(cacheKey, null);
 					return apiError("Bundle not found", 404);

src/app/api/admin/import/clone/route.ts

@@ -1,5 +1,6 @@
 import { apiError, apiOk } from "@/lib/api";
 import { withAdmin } from "@/lib/api-handler";
+import { assertSafeImportUrl } from "@/lib/import-url-safety";
 import { PERMS } from "@/lib/permissions";
 import { logAudit } from "@/lib/services/audit";
 import {
@@ -87,22 +88,25 @@ export const POST = withAdmin(
 		} = body as Record<string, string>;
 		const enabledRaw = (body as Record<string, unknown>).enabled;
 
-		const isHttps = (u: string) => {
-			try {
-				return new URL(u).protocol === "https:";
-			} catch {
-				return false;
-			}
-		};
-
 		if (!name?.trim()) return apiError("name is required", 400);
 		if (!furnidataUrl?.trim()) return apiError("furnidataUrl is required", 400);
 
 		const normalized = (u: string | undefined) =>
 			(u ?? "").trim().replace(/\/+$/, "");
 
-		if (!isHttps(furnidataUrl))
-			return apiError("furnidataUrl must be a valid https:// URL", 400);
+		for (const [label, rawUrl] of [
+			["furnidataUrl", furnidataUrl],
+			["nitroBaseUrl", nitroBaseUrl],
+			["iconBaseUrl", iconBaseUrl],
+			["sourceSwfBaseUrl", sourceSwfBaseUrl],
+		] as const) {
+			if (!rawUrl?.trim()) continue;
+			try {
+				await assertSafeImportUrl(rawUrl, label);
+			} catch (err) {
+				return apiError((err as Error).message, 400);
+			}
+		}
 
 		const entry = await upsertSource({
 			id,