Address production-readiness review: clearer errors, safer votes, and ops hardening.

Distinguish auth/lookup failures, make votes idempotent on visible questions, bound shutdown, page admin users, LRU throttle, trusted-proxy CIDRs, avatar cleanup, versioned migrations, and session cleanup logging.

db/queries/votes.sql

@@ -3,12 +3,22 @@ SELECT value
 FROM votes
 WHERE user_id = $1 AND question_id = $2;
 
+-- name: QuestionIsVisible :one
+SELECT EXISTS(
+  SELECT 1 FROM questions WHERE id = $1 AND hidden = 0
+)::bool;
+
 -- name: DeleteVote :exec
 DELETE FROM votes
 WHERE user_id = $1 AND question_id = $2;
 
--- name: UpsertVote :exec
+-- name: UpsertVoteOnVisible :execrows
 INSERT INTO votes (user_id, question_id, value)
-VALUES ($1, $2, $3)
+SELECT $1, $2, $3
+FROM questions q
+WHERE q.id = $2 AND q.hidden = 0
 ON CONFLICT (user_id, question_id) DO UPDATE
-SET value = excluded.value;
+SET value = excluded.value
+WHERE EXISTS (
+  SELECT 1 FROM questions q2 WHERE q2.id = excluded.question_id AND q2.hidden = 0
+);