fix(imaging): make avatar and badge images resilient to upstream outages

- Add persistent disk cache for rendered avatars/badges (storage/imaging)
  so repeats never touch the flaky local renderer and cached renders
  survive upstream downtime
- Serve cache-first with stale-on-error; cut primary/fallback timeouts
  from 10s/6s to 4s/4s so failing images cannot stall pages
- Avatar proxy now returns a graceful 200 silhouette instead of 502 when
  no renderer can produce a figure, so no broken-image glyphs appear
- Badge endpoint becomes a caching proxy trying configured CDN, public
  Habbo CDN and local /swf copy in order, and drops the fragile IP rate
  limit that could blank badge streams
- Route all site badge images (profile, me, badges, apply pages) through
  the cached proxy instead of hot-linking images.habbo.com

src/app/(site)/apply/staff/page.tsx

@@ -28,8 +28,8 @@ export async function generateMetadata(): Promise<Metadata> {
 	};
 }
 
-// Canonical Habbo badge image CDN (same base used by the profile page).
-const BADGE_IMG_BASE = "https://images.habbo.com/c_images/album1584";
+// Badge codes map to a .gif served through the cached proxy.
+const BADGE_IMG_BASE = "/api/imaging/badge?code";
 
 function feedbackStyle(tone: "success" | "error"): CSSProperties {
 	const accent =
@@ -144,7 +144,7 @@ export default async function ApplyStaffPage({
 									{team?.badge ? (
 										/* eslint-disable-next-line @next/next/no-img-element */
 										<img
-											src={`${BADGE_IMG_BASE}/${team.badge}.gif`}
+											src={`${BADGE_IMG_BASE}=${encodeURIComponent(team.badge)}`}
 											alt={rankName}
 											width={40}
 											height={40}

src/app/(site)/apply/team/page.tsx

@@ -22,8 +22,8 @@ export async function generateMetadata(): Promise<Metadata> {
 	};
 }
 
-// Canonical Habbo badge image CDN (same base used by the profile page).
-const BADGE_IMG_BASE = "https://images.habbo.com/c_images/album1584";
+// Badge codes map to a .gif served through the cached proxy.
+const BADGE_IMG_BASE = "/api/imaging/badge?code";
 
 function feedbackStyle(tone: "success" | "error"): CSSProperties {
 	const accent =
@@ -122,7 +122,7 @@ export default async function ApplyTeamPage({
 									{team.badge ? (
 										/* eslint-disable-next-line @next/next/no-img-element */
 										<img
-											src={`${BADGE_IMG_BASE}/${team.badge}.gif`}
+											src={`${BADGE_IMG_BASE}=${encodeURIComponent(team.badge)}`}
 											alt={team.rankName}
 											width={40}
 											height={40}

src/app/(site)/badges/page.tsx

@@ -17,8 +17,8 @@ export async function generateMetadata(): Promise<Metadata> {
 	};
 }
 
-// Canonical Habbo badge image CDN. A badge_key (e.g. "ADM") maps to a .gif here.
-const BADGE_IMG_BASE = "https://images.habbo.com/c_images/album1584";
+// A badge_key (e.g. "ADM") maps to a .gif served through the cached proxy.
+const BADGE_IMG_BASE = "/api/imaging/badge?code";
 
 export default async function BadgesPage() {
 	const t = await getTranslations("pages.badges");
@@ -50,7 +50,7 @@ export default async function BadgesPage() {
 							>
 								{/* eslint-disable-next-line @next/next/no-img-element */}
 								<img
-									src={`${BADGE_IMG_BASE}/${badge.badgeKey}.gif`}
+									src={`${BADGE_IMG_BASE}=${encodeURIComponent(badge.badgeKey)}`}
 									alt={badge.badgeName}
 									title={badge.badgeKey}
 									width={40}

src/app/(site)/me/page.tsx

@@ -10,7 +10,7 @@ import { ProfileImage } from "@/components/shared/profile-image";
 import { UserAvatarThumbnail } from "@/components/shared/user-avatar-thumbnail";
 import { SurfaceCard } from "@/components/surface-card";
 import { auth } from "@/lib/auth";
-import { avatarImageUrl, slugify } from "@/lib/format";
+import { avatarImageUrl, badgeImageUrl, slugify } from "@/lib/format";
 import { withPublicPagePerformance } from "@/lib/public-page-performance";
 import { loadDailyRewardState } from "@/lib/services/daily-rewards";
 import { loadUserDashboard } from "@/lib/services/user-dashboard";
@@ -456,7 +456,7 @@ async function MePage({
 								{badges.map((badge) => (
 									<img
 										key={badge.badgeCode}
-										src={`https://images.habbo.com/c_images/album1584/${encodeURIComponent(badge.badgeCode)}.gif`}
+										src={badgeImageUrl(badge.badgeCode)}
 										alt={badge.badgeCode}
 										title={badge.badgeCode}
 										width={40}

src/app/(site)/u/[username]/page.tsx

@@ -71,8 +71,8 @@ export async function generateMetadata({
 	};
 }
 
-// Canonical Habbo badge image CDN. Badge codes (e.g. "ADM") map to a .gif here.
-const BADGE_IMG_BASE = "https://images.habbo.com/c_images/album1584";
+// Badge codes (e.g. "ADM") map to a .gif served through the cached proxy.
+const BADGE_IMG_BASE = "/api/imaging/badge?code";
 
 // Emulator currency type ids (see UsersCurrency model): Duckets=0, Diamonds=5.
 const CURRENCY_DUCKETS = 0;
@@ -514,12 +514,7 @@ async function ProfilePage({
 											<details key={b.id} className={styles.badge}>
 												<summary title={name}>
 													<img
-														src={
-															BADGE_IMG_BASE +
-															"/" +
-															encodeURIComponent(b.badgeCode) +
-															".gif"
-														}
+														src={`${BADGE_IMG_BASE}=${encodeURIComponent(b.badgeCode)}`}
 														alt={name}
 														width={40}
 														height={40}

src/app/api/imaging/avatar/route.ts

@@ -1,5 +1,33 @@
 import { type NextRequest, NextResponse } from "next/server";
-import { fetchAvatarImage, parseAvatarQuery } from "@/lib/imager-upstream";
+import { AVATAR_FALLBACK_SRC } from "@/lib/imager";
+import {
+	fetchAvatarImage,
+	ImagerUnavailableError,
+	parseAvatarQuery,
+} from "@/lib/imager-upstream";
+
+// The same neutral silhouette the client fallback uses, served as a real 200
+// response when no upstream can render the figure. Images on server-rendered
+// pages therefore never show a broken-image glyph; browsers revalidate quickly
+// (`no-cache`) and pick up real renders as soon as an upstream recovers.
+const PLACEHOLDER_SVG_BYTES = new TextEncoder().encode(
+	decodeURIComponent(
+		AVATAR_FALLBACK_SRC.slice("data:image/svg+xml;utf8,".length),
+	),
+);
+
+function cacheControlFor(source: string): string {
+	switch (source) {
+		case "fallback":
+		case "cache-stale":
+			// Reuse the render briefly but revalidate the upstream soon.
+			return "public, max-age=300";
+		case "unavailable":
+			return "no-cache, max-age=0";
+		default:
+			return "public, max-age=3600";
+	}
+}
 
 export async function GET(request: NextRequest) {
 	const { searchParams } = new URL(request.url);
@@ -20,17 +48,24 @@ export async function GET(request: NextRequest) {
 			headers: {
 				"Content-Type": contentType,
 				"Content-Length": String(body.length),
-				// Fallback renders are served with a short TTL so the configured
-				// imager is retried soon instead of being masked for hours.
-				"Cache-Control":
-					source === "fallback"
-						? "public, max-age=300"
-						: "public, max-age=3600",
+				"Cache-Control": cacheControlFor(source),
 				"X-Imager-Source": source,
 				"Access-Control-Allow-Origin": "*",
 			},
 		});
-	} catch {
+	} catch (error) {
+		if (error instanceof ImagerUnavailableError) {
+			return new NextResponse(PLACEHOLDER_SVG_BYTES as unknown as BodyInit, {
+				status: 200,
+				headers: {
+					"Content-Type": "image/svg+xml",
+					"Content-Length": String(PLACEHOLDER_SVG_BYTES.length),
+					"Cache-Control": cacheControlFor("unavailable"),
+					"X-Imager-Source": "unavailable",
+					"Access-Control-Allow-Origin": "*",
+				},
+			});
+		}
 		return NextResponse.json(
 			{ error: "Failed to fetch avatar from upstream" },
 			{ status: 502 },