perf: optimize CMS queries, caching, and asset delivery

Database:
- Add missing indexes (users.credits, users_currency(type,amount),
  users_settings.respects_received, camera_web.timestamp,
  messenger_offline.user_id) via migrations 0020/0021
- Use partial .select() everywhere instead of SELECT * (tickets, users,
  rooms, audit logs, catalog tree, polls, radio, password reset)
- Add queryPrepared/queryPreparedOne (server-side prepared statements)
  and switch the login check to a prepared statement; drop dead
  cache options from the pool config
- Raise total_users/total_rooms COUNT(*) cache TTL to 5m

Caching:
- Consolidate the three cache helpers (cached, redisCache, cachedQuery)
  into a single memory-first implementation backed by Redis
- invalidateKey now clears the in-process cache as well as Redis
- Cache homepage sections, news list, and leaderboard tabs; share one
  news_list cache key between homepage and news archive
- siteSettings: in-process cache with TTL so repeated getters no longer
  pay a Redis round-trip per call
- Share a 10s poll cache across all radio SSE connections
- Normalize timestamps after cache reads (Redis JSON round-trip)

Assets:
- Enable AVIF/WebP via images.formats and remove unoptimized from news
  covers and the homepage hero (149KB jpg) with proper sizes/priority
- Support ?format=webp|avif|png in the /imaging proxy via sharp

Other:
- Fix pnpm supply-chain minimumReleaseAge failures by excluding the
  freshly-published packages (next 16.3.1, hookform resolvers 5.8.0,
  resend 6.20.0)
- Remove unused before/after fields from housekeeping AuditEntry

src/lib/cached-db.ts

@@ -1,52 +1,32 @@
 import "server-only";
 
-import { logger } from "@/lib/logger";
+import { cached, invalidateMemory } from "@/lib/cache";
 import { redis } from "@/lib/redis";
 
 const DEFAULT_CACHE_TTL = 60;
 
-function isRedisAvailable(): boolean {
-	return !!redis && redis.status !== "end";
-}
-
+/**
+ * Redis-backed cached query with an in-process fast path (see `cached()`).
+ * Use for read-heavy lookups that are safe to serve slightly stale
+ * (login user, article bodies, …). Redis stays the shared source of truth.
+ */
 export async function cachedQuery<T>(
 	cacheKey: string,
 	queryFn: () => Promise<T>,
 	ttl: number = DEFAULT_CACHE_TTL,
 ): Promise<T> {
-	if (!isRedisAvailable()) {
-		return queryFn();
-	}
-
-	try {
-		const cached = await redis?.get(cacheKey);
-		if (cached !== null && cached !== undefined) {
-			return JSON.parse(cached) as T;
-		}
-	} catch (err) {
-		logger.warn("[cache] read failed, falling back to DB", {
-			key: cacheKey,
-			error: String(err),
-		});
-	}
-
-	const result = await queryFn();
-
-	try {
-		await redis?.setex(cacheKey, ttl, JSON.stringify(result));
-	} catch (err) {
-		logger.warn("[cache] write failed, continuing without cache", {
-			key: cacheKey,
-			error: String(err),
-		});
-	}
-
-	return result;
+	return cached(cacheKey, ttl * 1000, queryFn);
 }
 
-/** Invalidate a single cache key immediately. */
+/** Invalidate a single cache key immediately (memory + Redis). */
 export async function invalidateKey(key: string): Promise<number> {
-	if (!isRedisAvailable()) return 0;
-	if (!redis) return 0;
-	return redis.del(key);
+	invalidateMemory(key);
+	if (redis && redis.status !== "end") {
+		try {
+			return await redis.del(key);
+		} catch {
+			return 0;
+		}
+	}
+	return 0;
 }