fix(imaging): make avatar and badge images resilient to upstream outages

- Add persistent disk cache for rendered avatars/badges (storage/imaging)
  so repeats never touch the flaky local renderer and cached renders
  survive upstream downtime
- Serve cache-first with stale-on-error; cut primary/fallback timeouts
  from 10s/6s to 4s/4s so failing images cannot stall pages
- Avatar proxy now returns a graceful 200 silhouette instead of 502 when
  no renderer can produce a figure, so no broken-image glyphs appear
- Badge endpoint becomes a caching proxy trying configured CDN, public
  Habbo CDN and local /swf copy in order, and drops the fragile IP rate
  limit that could blank badge streams
- Route all site badge images (profile, me, badges, apply pages) through
  the cached proxy instead of hot-linking images.habbo.com

src/lib/runtime-avatar-route.test.ts

@@ -1,7 +1,16 @@
 import { NextRequest } from "next/server";
-import { afterEach, expect, it, vi } from "vitest";
+import { afterEach, beforeEach, expect, it, vi } from "vitest";
 import { GET } from "../app/api/imaging/avatar/route";
 
+beforeEach(() => {
+	// Fresh, isolated cache root per test run so the disk cache can never leak
+	// state between runs or into the runtime cache.
+	vi.stubEnv(
+		"IMAGING_CACHE_ROOT",
+		`${process.cwd()}/storage/imaging/test-route-${process.pid}-${Date.now()}`,
+	);
+});
+
 afterEach(() => {
 	vi.unstubAllEnvs();
 	vi.unstubAllGlobals();
@@ -66,3 +75,44 @@ it("falls back to the public Habbo renderer when the configured imager is down",
 	expect(target.searchParams.get("img_format")).toBe("png");
 	expect(target.searchParams.has("effect")).toBe(false);
 });
+
+it("serves a previously rendered avatar from the disk cache without re-fetching", async () => {
+	const fetcher = vi.fn(
+		async (_input: string | URL) =>
+			new Response(new Uint8Array([9, 8, 7]), {
+				headers: { "content-type": "image/png" },
+			}),
+	);
+	vi.stubGlobal("fetch", fetcher);
+	vi.stubEnv("IMAGER_URL", "https://cache.test/avatarimage");
+	const request = new NextRequest(
+		"https://hotel.test/api/imaging/avatar?figure=hd-123-1",
+	);
+	const first = await GET(request);
+	expect(first.status).toBe(200);
+	const callsAfterFirst = fetcher.mock.calls.length;
+	expect(callsAfterFirst).toBeGreaterThan(0);
+
+	const second = await GET(request);
+	expect(second.status).toBe(200);
+	expect(second.headers.get("x-imager-source")).toBe("cache");
+	expect(second.headers.get("cache-control")).toContain("max-age=3600");
+	// The cached render must not touch the upstream again.
+	expect(fetcher.mock.calls.length).toBe(callsAfterFirst);
+});
+
+it("serves a graceful silhouette instead of a broken image when every upstream is down", async () => {
+	const fetcher = vi.fn(
+		async (_input: string | URL) =>
+			new Response("renderer unreachable", { status: 503 }),
+	);
+	vi.stubGlobal("fetch", fetcher);
+	vi.stubEnv("IMAGER_URL", "https://down.test/avatarimage");
+	const result = await GET(
+		new NextRequest("https://hotel.test/api/imaging/avatar?figure=xd-900-1"),
+	);
+	expect(result.status).toBe(200);
+	expect(result.headers.get("content-type")).toBe("image/svg+xml");
+	expect(result.headers.get("x-imager-source")).toBe("unavailable");
+	expect(result.headers.get("cache-control")).toContain("no-cache");
+});