Address production-readiness review: clearer errors, safer votes, and ops hardening.

Distinguish auth/lookup failures, make votes idempotent on visible questions, bound shutdown, page admin users, LRU throttle, trusted-proxy CIDRs, avatar cleanup, versioned migrations, and session cleanup logging.

internal/store/sqlc/users.sql.go

@@ -129,10 +129,27 @@ func (q *Queries) GetUserRole(ctx context.Context, id string) (string, error) {
 const listUsers = `-- name: ListUsers :many
 SELECT id, username, name, role, avatar_url, state, created_at
 FROM users
-ORDER BY created_at ASC
-LIMIT $1
+WHERE (
+  $1 = ''
+  OR username ILIKE '%' || $1 || '%'
+  OR name ILIKE '%' || $1 || '%'
+)
+AND (
+  $2 = ''
+  OR created_at < $2
+  OR (created_at = $2 AND id < $3)
+)
+ORDER BY created_at DESC, id DESC
+LIMIT $4
 `
 
+type ListUsersParams struct {
+	Search        interface{}
+	CursorCreated interface{}
+	CursorID      string
+	RowLimit      int32
+}
+
 type ListUsersRow struct {
 	ID        string
 	Username  string
@@ -143,8 +160,13 @@ type ListUsersRow struct {
 	CreatedAt string
 }
 
-func (q *Queries) ListUsers(ctx context.Context, rowLimit int32) ([]ListUsersRow, error) {
-	rows, err := q.db.QueryContext(ctx, listUsers, rowLimit)
+func (q *Queries) ListUsers(ctx context.Context, arg ListUsersParams) ([]ListUsersRow, error) {
+	rows, err := q.db.QueryContext(ctx, listUsers,
+		arg.Search,
+		arg.CursorCreated,
+		arg.CursorID,
+		arg.RowLimit,
+	)
 	if err != nil {
 		return nil, err
 	}