perf: optimize CMS queries, caching, and asset delivery

Database:
- Add missing indexes (users.credits, users_currency(type,amount),
  users_settings.respects_received, camera_web.timestamp,
  messenger_offline.user_id) via migrations 0020/0021
- Use partial .select() everywhere instead of SELECT * (tickets, users,
  rooms, audit logs, catalog tree, polls, radio, password reset)
- Add queryPrepared/queryPreparedOne (server-side prepared statements)
  and switch the login check to a prepared statement; drop dead
  cache options from the pool config
- Raise total_users/total_rooms COUNT(*) cache TTL to 5m

Caching:
- Consolidate the three cache helpers (cached, redisCache, cachedQuery)
  into a single memory-first implementation backed by Redis
- invalidateKey now clears the in-process cache as well as Redis
- Cache homepage sections, news list, and leaderboard tabs; share one
  news_list cache key between homepage and news archive
- siteSettings: in-process cache with TTL so repeated getters no longer
  pay a Redis round-trip per call
- Share a 10s poll cache across all radio SSE connections
- Normalize timestamps after cache reads (Redis JSON round-trip)

Assets:
- Enable AVIF/WebP via images.formats and remove unoptimized from news
  covers and the homepage hero (149KB jpg) with proper sizes/priority
- Support ?format=webp|avif|png in the /imaging proxy via sharp

Other:
- Fix pnpm supply-chain minimumReleaseAge failures by excluding the
  freshly-published packages (next 16.3.1, hookform resolvers 5.8.0,
  resend 6.20.0)
- Remove unused before/after fields from housekeeping AuditEntry

src/lib/services/news-list.ts

@@ -0,0 +1,57 @@
+import "server-only";
+
+import { desc } from "drizzle-orm";
+import { cached } from "@/lib/cache";
+import { db, WebsiteArticles } from "@/lib/db";
+
+export interface NewsListItem {
+	slug: string;
+	title: string;
+	shortStory: string;
+	image: string;
+	createdAt: Date | null;
+}
+
+interface NewsListRow {
+	slug: string;
+	title: string;
+	shortStory: string;
+	image: string;
+	createdAt: Date | null;
+}
+
+const TTL_MS = 300_000;
+const CACHE_KEY = "news_list";
+const FETCH_LIMIT = 30;
+
+/**
+ * Shared, cached news list used by both the homepage and the news archive so
+ * a single "news_list" cache entry serves both routes. Returns at most
+ * `limit` rows with `createdAt` normalized to a Date (the cache round-trip
+ * serializes timestamps to ISO strings).
+ */
+export async function getNewsList(limit: number): Promise<NewsListItem[]> {
+	try {
+		const rows = await cached<NewsListRow[]>(CACHE_KEY, TTL_MS, () =>
+			db
+				.select({
+					slug: WebsiteArticles.slug,
+					title: WebsiteArticles.title,
+					shortStory: WebsiteArticles.shortStory,
+					image: WebsiteArticles.image,
+					createdAt: WebsiteArticles.createdAt,
+				})
+				.from(WebsiteArticles)
+				.orderBy(desc(WebsiteArticles.createdAt))
+				.limit(FETCH_LIMIT),
+		);
+		return rows
+			.map((a) => ({
+				...a,
+				createdAt: a.createdAt ? new Date(a.createdAt) : null,
+			}))
+			.slice(0, limit);
+	} catch {
+		return [];
+	}
+}