perf: optimize DB layer with caching and pool tuning

- Add Redis cache wrapper (cached-db.ts) — cachedQuery + invalidate helpers
- Add cached login user lookup (auth.ts: getLoginUser) — short 15s TTL
  for brute-force protection, cache invalidation on password/rank changes
- Switch auth.ts login flow from Prisma facade to raw SQL via db.execute
  (avoids abstraction overhead for this hot path)
- Cache invalidation wired in: login password upgrade, updateUser, resetPassword
- Connection pool tuning: enableKeepAlive, namedPlaceholders,
  prepared statement cache (Node 22+), multipleStatements off (SQLi hardening)
- 0 tsc errors, 583 tests passing

src/lib/db.ts

@@ -34,8 +34,16 @@ function createDb(): MySql2Database<typeof fullSchema> {
 		queueLimit: 0,
 		connectTimeout,
 		idleTimeout: env.DATABASE_IDLE_TIMEOUT_MS,
-		// Keep BIGINT precision; safe values come back as numbers, huge ones as
-		// strings (drizzle bigint mode maps both to JS bigint).
+		enableKeepAlive: true,
+		// Prepared-statement caching via mysql2's native support (Node 22+).
+		// Saves query-parse per request on hot paths.
+		...("cache" in mysql.createPool && {
+			cache: { type: "prepared" },
+		}),
+		// Allow :placeholder syntax for raw SQL helpers.
+		namedPlaceholders: true,
+		// Reject multiple statements (SQL injection hardening).
+		multipleStatements: false,
 		supportBigNumbers: true,
 	});