perf: optimize CMS queries, caching, and asset delivery

Database:
- Add missing indexes (users.credits, users_currency(type,amount),
  users_settings.respects_received, camera_web.timestamp,
  messenger_offline.user_id) via migrations 0020/0021
- Use partial .select() everywhere instead of SELECT * (tickets, users,
  rooms, audit logs, catalog tree, polls, radio, password reset)
- Add queryPrepared/queryPreparedOne (server-side prepared statements)
  and switch the login check to a prepared statement; drop dead
  cache options from the pool config
- Raise total_users/total_rooms COUNT(*) cache TTL to 5m

Caching:
- Consolidate the three cache helpers (cached, redisCache, cachedQuery)
  into a single memory-first implementation backed by Redis
- invalidateKey now clears the in-process cache as well as Redis
- Cache homepage sections, news list, and leaderboard tabs; share one
  news_list cache key between homepage and news archive
- siteSettings: in-process cache with TTL so repeated getters no longer
  pay a Redis round-trip per call
- Share a 10s poll cache across all radio SSE connections
- Normalize timestamps after cache reads (Redis JSON round-trip)

Assets:
- Enable AVIF/WebP via images.formats and remove unoptimized from news
  covers and the homepage hero (149KB jpg) with proper sizes/priority
- Support ?format=webp|avif|png in the /imaging proxy via sharp

Other:
- Fix pnpm supply-chain minimumReleaseAge failures by excluding the
  freshly-published packages (next 16.3.1, hookform resolvers 5.8.0,
  resend 6.20.0)
- Remove unused before/after fields from housekeeping AuditEntry

src/lib/db.ts

@@ -1,4 +1,5 @@
-import { drizzle, type MySql2Database } from "drizzle-orm/mysql2";
+import { drizzle } from "drizzle-orm/mysql2";
+import type { Pool as MySqlPool } from "mysql2/promise";
 import mysql from "mysql2/promise";
 import * as relations from "@/db/relations";
 import * as schema from "@/db/schema";
@@ -8,10 +9,10 @@ import { resolveConnectionLimit } from "@/lib/db-pool";
 const fullSchema = { ...schema, ...relations };
 
 const globalForDb = globalThis as unknown as {
-	db?: MySql2Database<typeof fullSchema>;
+	db?: ReturnType<typeof createDb>;
 };
 
-function createDb(): MySql2Database<typeof fullSchema> {
+function createDb() {
 	const url = new URL(env.DATABASE_URL);
 	const isBuild =
 		process.env.NEXT_PHASE === "phase-production-build" ||
@@ -35,11 +36,6 @@ function createDb(): MySql2Database<typeof fullSchema> {
 		connectTimeout,
 		idleTimeout: env.DATABASE_IDLE_TIMEOUT_MS,
 		enableKeepAlive: true,
-		// Prepared-statement caching via mysql2's native support (Node 22+).
-		// Saves query-parse per request on hot paths.
-		...("cache" in mysql.createPool && {
-			cache: { type: "prepared" },
-		}),
 		// Allow :placeholder syntax for raw SQL helpers.
 		namedPlaceholders: true,
 		// Reject multiple statements (SQL injection hardening).
@@ -65,6 +61,37 @@ export const db = globalForDb.db ?? createDb();
 
 if (env.NODE_ENV !== "production") globalForDb.db = db;
 
-export type Db = MySql2Database<typeof fullSchema>;
+export type Db = ReturnType<typeof createDb>;
+
+type PreparedValue = string | number | bigint | boolean | Date | null | Buffer;
+
+/**
+ * Server-side prepared statements (mysql2 pool.execute()).
+ *
+ * Drizzle's mysql2 driver runs `.select()` through the text protocol
+ * (pool.query()), so it never uses server-side prepared statements. For
+ * hot-path queries the SQL is parsed once on the server per connection
+ * instead of every execution. Column aliases let you pick exactly the
+ * columns you need (no SELECT *).
+ */
+export async function queryPrepared<T extends Record<string, unknown>>(
+	sql: string,
+	params?: PreparedValue[],
+): Promise<T[]> {
+	const client = db.$client as MySqlPool;
+	const [rows] = (await client.execute(sql, params)) as unknown as [
+		T[],
+		unknown,
+	];
+	return rows ?? [];
+}
+
+export async function queryPreparedOne<T extends Record<string, unknown>>(
+	sql: string,
+	params?: PreparedValue[],
+): Promise<T | null> {
+	const rows = await queryPrepared<T>(sql, params);
+	return rows[0] ?? null;
+}
 
 export * from "@/db/schema";