Address production-readiness review: clearer errors, safer votes, and ops hardening.

Distinguish auth/lookup failures, make votes idempotent on visible questions, bound shutdown, page admin users, LRU throttle, trusted-proxy CIDRs, avatar cleanup, versioned migrations, and session cleanup logging.

internal/web/admin.go

@@ -3,6 +3,8 @@ package web
 import (
 	"errors"
 	"net/http"
+	"net/url"
+	"strings"
 
 	"github.com/go-chi/chi/v5"
 
@@ -11,8 +13,11 @@ import (
 
 type adminUsersPage struct {
 	page
-	Users []store.User
-	Error string
+	Users      []store.User
+	Error      string
+	Search     string
+	NextCursor string
+	HasMore    bool
 }
 
 func (s *Server) requireAdmin(w http.ResponseWriter, r *http.Request) *store.User {
@@ -28,14 +33,35 @@ func (s *Server) handleAdminUsers(w http.ResponseWriter, r *http.Request) {
 	if s.requireAdmin(w, r) == nil {
 		return
 	}
-	users, err := s.store.ListUsers(r.Context())
+	search := strings.TrimSpace(r.URL.Query().Get("q"))
+	cursorCreated := r.URL.Query().Get("cursor_created")
+	cursorID := r.URL.Query().Get("cursor_id")
+	users, nextCreated, nextID, err := s.store.ListUsers(r.Context(), store.ListUsersQuery{
+		Search:        search,
+		CursorCreated: cursorCreated,
+		CursorID:      cursorID,
+		Limit:         store.AdminUsersLimit,
+	})
 	if err != nil {
 		http.Error(w, "could not load users", http.StatusInternalServerError)
 		return
 	}
+	next := ""
+	if nextCreated != "" {
+		v := url.Values{}
+		if search != "" {
+			v.Set("q", search)
+		}
+		v.Set("cursor_created", nextCreated)
+		v.Set("cursor_id", nextID)
+		next = "/admin/users?" + v.Encode()
+	}
 	s.exec(w, "admin-users", adminUsersPage{
-		page:  s.basePage(r, "Users"),
-		Users: users,
+		page:       s.basePage(r, "Users"),
+		Users:      users,
+		Search:     search,
+		NextCursor: next,
+		HasMore:    next != "",
 	})
 }
 
@@ -50,7 +76,7 @@ func (s *Server) handleAdminSetRole(w http.ResponseWriter, r *http.Request) {
 	role := store.Role(r.PostFormValue("role"))
 	err := s.store.SetUserRole(r.Context(), id, role)
 	if errors.Is(err, store.ErrLastAdmin) {
-		users, listErr := s.store.ListUsers(r.Context())
+		users, _, _, listErr := s.store.ListUsers(r.Context(), store.ListUsersQuery{Limit: store.AdminUsersLimit})
 		if listErr != nil {
 			http.Error(w, "could not demote last admin", http.StatusBadRequest)
 			return