fix(imaging): support .hab assets, cache avatars/badges, harden routes

The hotel moved from .nitro to .hab bundles, so the imager must treat .hab
like .nitro and the public avatar endpoints must accept the figure strings
the client sends (including extra trailing segments such as `.0`, which the
old FIGURE_RE rejected with a 400).

- imager-upstream: relax FIGURE_RE, extend parseAvatarQuery test coverage
- api/imaging/avatar + /imaging: shared validation, placeholder and ETag/304
- api/imaging/badge: single-flight upstream fetch and conditional responses
- imager-http/imager-png: strong ETag helpers and APNG passthrough guard
- csp + next/image: unoptimized external images, tightened CSP
- deps: override postcss-selector-parser to ^7.1.6
- also fold in the pending drizzle draft snapshot and stray test cleanup

src/app/(site)/news/page.tsx

@@ -99,6 +99,7 @@ async function NewsPage({
 											fill
 											sizes="(max-width: 1024px) 50vw, 300px"
 											style={{ objectFit: "cover" }}
+											unoptimized
 										/>
 									</div>
 								) : (

src/app/(site)/page.tsx

@@ -170,12 +170,9 @@ function GlassPanel({
 }
 
 async function getHotelData() {
-	const [hotelName, logo] = await Promise.all([
-		resolveHotelName(),
-		siteSettings.get("cms_logo", ""),
-	]);
-
 	const [
+		hotelName,
+		logo,
 		online,
 		users,
 		rooms,
@@ -185,6 +182,8 @@ async function getHotelData() {
 		recentUsers,
 		recentPhotos,
 	] = await Promise.all([
+		resolveHotelName(),
+		siteSettings.get("cms_logo", ""),
 		cachedOnlineCount().catch(publicReadFailure("home.online")),
 		cached("total_users", 300_000, countUsers, { staleMs: 300000 }).catch(
 			publicReadFailure("home.users"),
@@ -243,22 +242,34 @@ export default async function Home() {
 	const session = await auth();
 	if (session?.user?.id) redirect("/me");
 
-	const tp = await getTranslations("pages.home");
-	const te = await getTranslations("publicData");
-	const th = await getTranslations("header");
-	const tn = await getTranslations("nav");
-	const {
-		hotelName,
-		online,
-		users,
-		rooms,
-		totalPhotos,
-		articleCount,
-		articles,
-		recentUsers: rawRecentUsers,
-		recentPhotos,
-		logo,
-	} = await getHotelData();
+	const [
+		tp,
+		te,
+		th,
+		tn,
+		{
+			hotelName,
+			online,
+			users,
+			rooms,
+			totalPhotos,
+			articleCount,
+			articles,
+			recentUsers: rawRecentUsers,
+			recentPhotos,
+			logo,
+		},
+		captcha,
+		nonceHeaders,
+	] = await Promise.all([
+		getTranslations("pages.home"),
+		getTranslations("publicData"),
+		getTranslations("header"),
+		getTranslations("nav"),
+		getHotelData(),
+		captchaConfig(),
+		headers(),
+	]);
 
 	// Users who hide their online state must not surface in the "who is online"
 	// rails on the homepage either.
@@ -271,8 +282,7 @@ export default async function Home() {
 			: rawRecentUsers.filter(
 					(u) => recentUserPrivacy.get(u.id)?.online !== false,
 				);
-	const captcha = await captchaConfig();
-	const nonce = (await headers()).get("x-nonce") ?? undefined;
+	const nonce = nonceHeaders.get("x-nonce") ?? undefined;
 
 	const features = [
 		{
@@ -315,6 +325,7 @@ export default async function Home() {
 					fill
 					sizes={featured ? "100vw" : "(max-width: 640px) 100vw, 33vw"}
 					className="rounded-2xl object-cover transition-transform duration-700 ease-out group-hover:scale-108"
+					unoptimized
 				/>
 				<div
 					className="absolute right-2.5 top-2.5 flex h-8 w-8 translate-x-1 items-center justify-center rounded-full opacity-0 backdrop-blur-sm transition-all duration-300 group-hover:translate-x-0 group-hover:opacity-100"