perf: optimize CMS queries, caching, and asset delivery

Database:
- Add missing indexes (users.credits, users_currency(type,amount),
  users_settings.respects_received, camera_web.timestamp,
  messenger_offline.user_id) via migrations 0020/0021
- Use partial .select() everywhere instead of SELECT * (tickets, users,
  rooms, audit logs, catalog tree, polls, radio, password reset)
- Add queryPrepared/queryPreparedOne (server-side prepared statements)
  and switch the login check to a prepared statement; drop dead
  cache options from the pool config
- Raise total_users/total_rooms COUNT(*) cache TTL to 5m

Caching:
- Consolidate the three cache helpers (cached, redisCache, cachedQuery)
  into a single memory-first implementation backed by Redis
- invalidateKey now clears the in-process cache as well as Redis
- Cache homepage sections, news list, and leaderboard tabs; share one
  news_list cache key between homepage and news archive
- siteSettings: in-process cache with TTL so repeated getters no longer
  pay a Redis round-trip per call
- Share a 10s poll cache across all radio SSE connections
- Normalize timestamps after cache reads (Redis JSON round-trip)

Assets:
- Enable AVIF/WebP via images.formats and remove unoptimized from news
  covers and the homepage hero (149KB jpg) with proper sizes/priority
- Support ?format=webp|avif|png in the /imaging proxy via sharp

Other:
- Fix pnpm supply-chain minimumReleaseAge failures by excluding the
  freshly-published packages (next 16.3.1, hookform resolvers 5.8.0,
  resend 6.20.0)
- Remove unused before/after fields from housekeeping AuditEntry

src/lib/services/radio.ts

@@ -27,6 +27,21 @@ export interface NowPlaying {
 	artist: string | null;
 }
 
+// Shared in-process poll cache: every connected SSE client (players, widgets)
+// would otherwise hit the radio API once per 10s each. With one cache entry per
+// endpoint, N connections cost 1 request per interval regardless of N.
+const POLL_CACHE_TTL_MS = 10_000;
+const pollCache = new Map<string, { data: unknown; expiresAt: number }>();
+
+async function cachedFetchJson(url: string, ms = 4000): Promise<unknown> {
+	const now = Date.now();
+	const hit = pollCache.get(url);
+	if (hit && hit.expiresAt > now) return hit.data;
+	const data = await fetchJson(url, ms);
+	pollCache.set(url, { data, expiresAt: now + POLL_CACHE_TTL_MS });
+	return data;
+}
+
 async function fetchJson(url: string, ms = 4000): Promise<unknown> {
 	if (!isSafeUrl(url)) return null;
 	const controller = new AbortController();
@@ -88,13 +103,13 @@ function parseNowPlaying(d: unknown): NowPlaying | null {
 export async function fetchNowPlaying(): Promise<NowPlaying | null> {
 	const url = (await siteSettings.get("radio_now_playing_api_url", "")) ?? "";
 	if (!url) return null;
-	return parseNowPlaying(await fetchJson(url));
+	return parseNowPlaying(await cachedFetchJson(url));
 }
 
 export async function fetchListeners(): Promise<number | null> {
 	const url = (await siteSettings.get("radio_listeners_api_url", "")) ?? "";
 	if (!url) return null;
-	const d = await fetchJson(url);
+	const d = await cachedFetchJson(url);
 	if (d == null) return null;
 	const obj = d as { listeners?: unknown; current_listeners?: unknown };
 	const raw =