perf: optimize CMS queries, caching, and asset delivery

Database:
- Add missing indexes (users.credits, users_currency(type,amount),
  users_settings.respects_received, camera_web.timestamp,
  messenger_offline.user_id) via migrations 0020/0021
- Use partial .select() everywhere instead of SELECT * (tickets, users,
  rooms, audit logs, catalog tree, polls, radio, password reset)
- Add queryPrepared/queryPreparedOne (server-side prepared statements)
  and switch the login check to a prepared statement; drop dead
  cache options from the pool config
- Raise total_users/total_rooms COUNT(*) cache TTL to 5m

Caching:
- Consolidate the three cache helpers (cached, redisCache, cachedQuery)
  into a single memory-first implementation backed by Redis
- invalidateKey now clears the in-process cache as well as Redis
- Cache homepage sections, news list, and leaderboard tabs; share one
  news_list cache key between homepage and news archive
- siteSettings: in-process cache with TTL so repeated getters no longer
  pay a Redis round-trip per call
- Share a 10s poll cache across all radio SSE connections
- Normalize timestamps after cache reads (Redis JSON round-trip)

Assets:
- Enable AVIF/WebP via images.formats and remove unoptimized from news
  covers and the homepage hero (149KB jpg) with proper sizes/priority
- Support ?format=webp|avif|png in the /imaging proxy via sharp

Other:
- Fix pnpm supply-chain minimumReleaseAge failures by excluding the
  freshly-published packages (next 16.3.1, hookform resolvers 5.8.0,
  resend 6.20.0)
- Remove unused before/after fields from housekeeping AuditEntry

src/app/imaging/route.ts

@@ -1,4 +1,5 @@
 import { type NextRequest, NextResponse } from "next/server";
+import sharp from "sharp";
 import { resolveImagerBase } from "@/lib/imager";
 
 const FIGURE_RE = /^([a-z]{2}-\d+)(\.[a-z]{2}-\d+)*$/i;
@@ -6,6 +7,19 @@ const FIGURE_MAX_LEN = 512;
 const FIGURE_MAX_PARTS = 24;
 const UPSTREAM_TIMEOUT_MS = 10_000;
 
+type AvatarFormat = "png" | "webp" | "avif";
+
+function resolveFormat(raw: string | null): AvatarFormat {
+	switch (raw?.toLowerCase()) {
+		case "webp":
+			return "webp";
+		case "avif":
+			return "avif";
+		default:
+			return "png";
+	}
+}
+
 export async function GET(request: NextRequest) {
 	const { searchParams } = new URL(request.url);
 
@@ -66,6 +80,8 @@ export async function GET(request: NextRequest) {
 	const imgFormat = searchParams.get("img_format");
 	if (imgFormat) params.set("img_format", imgFormat);
 
+	const format = resolveFormat(searchParams.get("format"));
+
 	const upstream = resolveImagerBase();
 	const upstreamUrl = `${upstream}?${params.toString()}`;
 
@@ -85,15 +101,35 @@ export async function GET(request: NextRequest) {
 			);
 		}
 
-		const buffer = await res.arrayBuffer();
-		const contentType = res.headers.get("content-type") || "image/png";
+		const buffer = Buffer.from(await res.arrayBuffer());
 
-		return new NextResponse(buffer, {
+		// Re-encode PNG avatars to WebP/AVIF with sharp to cut bandwidth.
+		// Falls back to the original PNG if conversion fails.
+		let body: Uint8Array = new Uint8Array(buffer);
+		let contentType = res.headers.get("content-type") || "image/png";
+		if (format !== "png") {
+			try {
+				if (format === "webp") {
+					body = new Uint8Array(await sharp(buffer).webp().toBuffer());
+					contentType = "image/webp";
+				} else {
+					body = new Uint8Array(await sharp(buffer).avif().toBuffer());
+					contentType = "image/avif";
+				}
+			} catch {
+				body = new Uint8Array(buffer);
+				contentType = res.headers.get("content-type") || "image/png";
+			}
+		}
+
+		return new NextResponse(body as unknown as BodyInit, {
 			status: 200,
 			headers: {
 				"Content-Type": contentType,
+				"Content-Length": String(body.length),
 				// s-maxage lets Cloudflare/edge cache avatars (currently DYNAMIC),
 				// stale-while-revalidate keeps them fresh without blocking requests.
+				// The ?format= param is part of the URL, so variants cache separately.
 				"Cache-Control":
 					"public, max-age=3600, s-maxage=86400, stale-while-revalidate=86400",
 				"Access-Control-Allow-Origin": "*",