Address production-readiness review: clearer errors, safer votes, and ops hardening.

Distinguish auth/lookup failures, make votes idempotent on visible questions, bound shutdown, page admin users, LRU throttle, trusted-proxy CIDRs, avatar cleanup, versioned migrations, and session cleanup logging.

templates/admin_users.html

@@ -4,6 +4,11 @@
   <p class="eyebrow">Admin</p>
   <h1>Users</h1>
   {{if .Error}}<p class="banner error" role="alert">{{.Error}}</p>{{end}}
+  <form class="ask" method="get" action="/admin/users" style="margin-bottom:1.5rem">
+    <label for="q">Search</label>
+    <input id="q" name="q" type="search" value="{{.Search}}" placeholder="username or name">
+    <button type="submit" class="btn btn-primary">Search</button>
+  </form>
   <div class="admin-users">
     <table class="user-table">
       <thead>
@@ -40,6 +45,9 @@
       </tbody>
     </table>
   </div>
+  {{if .HasMore}}
+  <p><a href="{{.NextCursor}}">Next page</a></p>
+  {{end}}
 </main>
 {{template "footer" .}}
 {{end}}

templates/partials/_vote.html

@@ -5,7 +5,7 @@
       hx-post="/questions/{{.Question.ID}}/vote"
       {{if eq .View "list"}}hx-target="#leaderboard" hx-swap="outerHTML"{{else}}hx-target="#vote-{{.Question.ID}}" hx-swap="outerHTML"{{end}}>
       <input type="hidden" name="_csrf" value="{{.CSRF}}">
-      <input type="hidden" name="value" value="1">
+      {{if eq .Question.UserVote 1}}<input type="hidden" name="value" value="0">{{else}}<input type="hidden" name="value" value="1">{{end}}
       <input type="hidden" name="view" value="{{.View}}">
       <input type="hidden" name="date" value="{{.Date}}">
       <button type="submit" class="vote-btn{{if eq .Question.UserVote 1}} is-up{{end}}" aria-label="Upvote" aria-pressed="{{if eq .Question.UserVote 1}}true{{else}}false{{end}}">
@@ -17,7 +17,7 @@
       hx-post="/questions/{{.Question.ID}}/vote"
       {{if eq .View "list"}}hx-target="#leaderboard" hx-swap="outerHTML"{{else}}hx-target="#vote-{{.Question.ID}}" hx-swap="outerHTML"{{end}}>
       <input type="hidden" name="_csrf" value="{{.CSRF}}">
-      <input type="hidden" name="value" value="-1">
+      {{if eq .Question.UserVote -1}}<input type="hidden" name="value" value="0">{{else}}<input type="hidden" name="value" value="-1">{{end}}
       <input type="hidden" name="view" value="{{.View}}">
       <input type="hidden" name="date" value="{{.Date}}">
       <button type="submit" class="vote-btn{{if eq .Question.UserVote -1}} is-down{{end}}" aria-label="Downvote" aria-pressed="{{if eq .Question.UserVote -1}}true{{else}}false{{end}}">