P1-P3 admin cleanup: rank guard, SSRF guard, count caching, dead code removal, pagination rewrite

- P1: new src/lib/admin/rank-guard.ts with tryGuardRank/guardRank + RankGuardTarget/Result; extracted from users.ts; applied to admin-bans (create/lift + rank redirect) and admin-badges (caps + rank guard + error surfacing); import-url-safety.ts SSRF guard wired into clone save+icon fetch; logAudit await in help-tickets; antiddos mutations SETTINGS_EDIT; markAllAlertsRead NOTIFICATIONS_EDIT; rankError/saveError in all 25 message files; tests rew/new for bans/badges/rank-guard/import-url-safety

- P2: ticket-inbox merged pagination reworked to single UNION ALL SQL with LIMIT/OFFSET (avoids O(offset) materialization); getCachedAdminCount with cacheFiltered option applied to devops/errors/photos/items/guilds/help-tickets/moderation pages; admin-theme catches→?error=1+banner+25 locales; logger in silent catches (rare-values/writeable-boxes); catalog-items-loader CAST→plain equality; count caching helper extended with opt-in cacheFiltered

- P3: removed dead modules is-staff/notice/recent-furni-resync/log-filters plus load-user-sanctions/user-sanction-timeline; removed orphaned CATALOG_PAGE_COLUMNS re-export; removed getFurniIconUrl from studio-furni-icons

Build: lint 0, typecheck 0, 3480 tests pass, i18n:check exit 0, colors exit 0. Circular chunk warning (9452/10535/66463) is webpack code-splitting artifact; build succeeds.

src/lib/services/admin-stats.ts

@@ -4,23 +4,27 @@ import { db } from "@/lib/db";
 import { redisCache } from "@/lib/redis-cache";
 
 /**
- * Caches admin list totals when no filters are applied (no 'where' clause),
- * preventing heavy COUNT(*) table scans on every request for large tables.
- * Filtered queries bypass cache to ensure exact search result counts.
+ * Caches admin list totals, preventing heavy COUNT(*) table scans on every
+ * request for large tables.
+ *
+ * By default only the unfiltered (global) count is cached; filtered queries
+ * hit the DB so search result counts stay exact. Callers that read a stable,
+ * fixed-filter total (e.g. "open tickets") can opt into caching it too with
+ * `{ cacheFiltered: true }` and a cacheKey unique to that filter.
  */
 export async function getCachedAdminCount(
 	table: MySqlTable,
 	cacheKey: string,
 	where?: SQL | undefined,
+	options?: { cacheFiltered?: boolean },
 ): Promise<number> {
-	// Only cache the global count (where = undefined)
-	if (where) {
+	const run = async (): Promise<number> => {
 		const [row] = await db.select({ total: count() }).from(table).where(where);
 		return Number(row?.total ?? 0);
-	}
+	};
 
-	return await redisCache(`admin:count:${cacheKey}`, 60, async () => {
-		const [row] = await db.select({ total: count() }).from(table);
-		return Number(row?.total ?? 0);
-	});
+	if (!where || options?.cacheFiltered) {
+		return await redisCache(`admin:count:${cacheKey}`, 60, run);
+	}
+	return await run();
 }

src/lib/services/catalog-items-loader.ts

@@ -127,13 +127,16 @@ export async function loadCatalogItemsData(
 	pageId: number,
 	catalog: "normal" | "bc" = "normal",
 ): Promise<CatalogItemsData> {
-	// Load items via raw query to work around pageId Int vs VARCHAR mismatch
+	// Load items via raw query to work around pageId Int vs VARCHAR mismatch.
+	// Bind the id as a *string* constant: MySQL/MariaDB coerce a constant to the
+	// column's type once, so `page_id = ?` stays sargable whether the live column
+	// is INT or VARCHAR. Casting the column (CAST(page_id AS CHAR)) would wrap it
+	// in a function and force a full table scan.
 	const pageIdStr = String(pageId);
-	// CAST: live Habbo DBs often store page_id as VARCHAR while schema maps Int.
 	const offers = catalog === "bc" ? "catalog_items_bc" : "catalog_items";
 	const rawItems = await queryRows<Record<string, unknown>>(sql`
     SELECT * FROM ${sql.raw(offers)}
-    WHERE CAST(page_id AS CHAR) = ${pageIdStr}
+    WHERE page_id = ${pageIdStr}
     ORDER BY order_number ASC, id ASC
   `);
 	// The BC table carries only a reference to the furniture: there are no price,

src/lib/services/clone-bulk-import-live.test.ts

@@ -14,7 +14,7 @@ const log = (msg: string) => appendFileSync(LOG, `${msg}\n`);
 const IMPORT_IDS = ["default-sodastudios", "default-hubbly"];
 
 describe("clone bulk import", {
-	skip: process.env.RUN_CLONE_BULK_LIVE !== "1",
+	skip: !runLive,
 }, () => {
 	beforeAll(async () => {
 		loadEnvForLiveTests();

src/lib/services/clone-feasibility-live.test.ts

@@ -11,7 +11,7 @@ const LOG = "/tmp/clone-feasibility.log";
 const log = (msg: string) => appendFileSync(LOG, `${msg}\n`);
 
 describe("clone feasibility", {
-	skip: process.env.RUN_CLONE_FEASIBILITY_LIVE !== "1",
+	skip: !runLive,
 }, () => {
 	beforeAll(async () => {
 		loadEnvForLiveTests();