Fix stability, security, and performance quick wins

[Sparksx]

Summary

Comprehensive codebase audit identified 23 improvements across security, stability, performance, and functionality. This PR implements the 10 highest-priority quick wins — high impact, low risk, minimal code change.

Stability fixes

• Remove duplicate SIGTERM/SIGINT handlers — prisma.js and index.js both registered shutdown handlers, causing a race where prisma.js called process.exit(0) before index.js could flush Socket.io connections and close the HTTP server cleanly
• Wrap clan rank management in transactions — promote/demote/kick loaded the actor and target outside a transaction, then mutated; a concurrent request could change roles between the permission check and the update, enabling privilege escalation
• Validate expedition reward values — guard against NaN/negative rewardXp/rewardGold from data corruption; early-return when no members joined
• Catch token cleanup interval errors — setInterval(asyncFn) silently dropped rejections, potentially leaking memory

Security fixes

• Enable Content Security Policy in production (was contentSecurityPolicy: false) — defense-in-depth against XSS
• Fix open redirect in payment checkout — req.headers.origin was used raw to build Stripe success/cancel URLs; now validated against an explicit allowlist

Performance fixes

• Optimize clan listing query — /api/clans loaded every member's full gameState for all 25 clans just to show a list; now uses _count only (members are loaded on detail view)
• Add composite index Expedition(status, endsAt) for the lazy-resolution timer query
• Raise Socket.io compression threshold from 1KB to 4KB — most chat messages are <1KB, so compression was wasting CPU

Minor fixes

• Null-safe chat serialization — deleted users caused username: undefined crash in conversation member list

Test plan

• All 308 existing tests pass (npm test)
• Lint passes with no new warnings (npm run lint)
• Production build succeeds (npm run build)
• Verify CSP doesn't block legitimate resources (Stripe checkout, WebSocket, inline styles)
• Test clan promote/demote/kick still works correctly
• Verify payment checkout redirects to correct origin

---

Remaining items from audit (not in this PR)

Priority	Issue
Medium	Stricter rate limiting on payment endpoints
Medium	Profile picture whitelist validation
Medium	PvP opponent pool query optimization
Medium	Chat history sender data over-fetching
Medium	i18n — extract ~40 hardcoded UI strings
Medium	Vite code splitting (admin, dungeon, chat)
High	Accessibility — ARIA attributes + keyboard navigation

🤖 Generated with Claude Code

https://claude.ai/code/session_01DoxYEXoRR2mhPGwqJd7Wdj

---

Generated by Claude Code