perf: optimize CMS queries, caching, and asset delivery

Database:
- Add missing indexes (users.credits, users_currency(type,amount),
  users_settings.respects_received, camera_web.timestamp,
  messenger_offline.user_id) via migrations 0020/0021
- Use partial .select() everywhere instead of SELECT * (tickets, users,
  rooms, audit logs, catalog tree, polls, radio, password reset)
- Add queryPrepared/queryPreparedOne (server-side prepared statements)
  and switch the login check to a prepared statement; drop dead
  cache options from the pool config
- Raise total_users/total_rooms COUNT(*) cache TTL to 5m

Caching:
- Consolidate the three cache helpers (cached, redisCache, cachedQuery)
  into a single memory-first implementation backed by Redis
- invalidateKey now clears the in-process cache as well as Redis
- Cache homepage sections, news list, and leaderboard tabs; share one
  news_list cache key between homepage and news archive
- siteSettings: in-process cache with TTL so repeated getters no longer
  pay a Redis round-trip per call
- Share a 10s poll cache across all radio SSE connections
- Normalize timestamps after cache reads (Redis JSON round-trip)

Assets:
- Enable AVIF/WebP via images.formats and remove unoptimized from news
  covers and the homepage hero (149KB jpg) with proper sizes/priority
- Support ?format=webp|avif|png in the /imaging proxy via sharp

Other:
- Fix pnpm supply-chain minimumReleaseAge failures by excluding the
  freshly-published packages (next 16.3.1, hookform resolvers 5.8.0,
  resend 6.20.0)
- Remove unused before/after fields from housekeeping AuditEntry

src/lib/cache.ts

@@ -5,6 +5,11 @@ import { redis } from "@/lib/redis";
 type CacheEntry<T> = { data: T; expiresAt: number };
 const memory = new Map<string, CacheEntry<unknown>>();
 
+/** Drop a key from the in-process cache (used when an upstream value changes). */
+export function invalidateMemory(key: string): void {
+	memory.delete(key);
+}
+
 /**
  * Redis-first cached query with an in-memory fallback.
  * Use for read-heavy endpoints polled by the browser (online count, etc.).
@@ -16,24 +21,29 @@ export async function cached<T>(
 ): Promise<T> {
 	const ttlSec = Math.ceil(ttlMs / 1000);
 
+	// In-memory fast path — served first so repeated reads within a TTL window
+	// don't each pay a Redis round-trip (Redis is still the shared fallback).
+	// `existing &&` short-circuits so Date.now() is never evaluated during
+	// prerender when the map is empty (keeps `next build` prerendering clean).
+	const existing = memory.get(key);
+	if (existing && existing.expiresAt > Date.now()) {
+		return existing.data as T;
+	}
+
 	// Redis path (shared across instances).
 	if (redis && redis.status !== "end") {
 		try {
 			const cached = await redis.get(key);
 			if (cached !== null && cached !== undefined) {
-				return JSON.parse(cached) as T;
+				const data = JSON.parse(cached) as T;
+				memory.set(key, { data, expiresAt: Date.now() + ttlMs });
+				return data;
 			}
 		} catch {
-			/* fall through to DB / memory */
+			/* fall through to fn */
 		}
 	}
 
-	// In-memory fallback (single-instance fast path).
-	const existing = memory.get(key);
-	if (existing && existing.expiresAt > Date.now()) {
-		return existing.data as T;
-	}
-
 	const data = await fn();
 
 	if (redis && redis.status !== "end") {