Address follow-up review: cheaper avatars, list limits, less chatter.

Switch avatar resize to ApproxBiLinear, cap hunt/profile/admin list queries, drop redundant admin/profile lookups, dedupe CI on app PRs, and refresh stale todo.md notes.

internal/store/postgres_test.go

@@ -1,6 +1,9 @@
 package store
 
-import "testing"
+import (
+	"strings"
+	"testing"
+)
 
 func TestNormalizeUsername(t *testing.T) {
 	if got := NormalizeUsername("  Alice_1 "); got != "alice_1" {
@@ -14,20 +17,7 @@ func TestPostgresDSNDefaultsSSLMode(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if !containsAny(out, "sslmode=verify-full") {
+	if !strings.Contains(out, "sslmode=verify-full") {
 		t.Fatalf("missing default sslmode: %s", out)
 	}
 }
-
-func containsAny(s string, parts ...string) bool {
-	for _, p := range parts {
-		if len(p) > 0 && (len(s) >= len(p)) {
-			for i := 0; i+len(p) <= len(s); i++ {
-				if s[i:i+len(p)] == p {
-					return true
-				}
-			}
-		}
-	}
-	return false
-}