chore(quality): resolve SonarQube code smells across website

Clears the 124 CODE_SMELL findings from the SonarQube scan (server, client,
and bot). All changes are behaviour-preserving refactors — no route, protocol,
schema, or config changes — verified against the full server (381) and client
(43) test suites plus a clean client build.

By rule:
- S3776 (20, cognitive complexity): extract helpers/handlers so each function
  drops under the threshold — shard model upsert builders, page/wiki update,
  block validation, notification stream mapping (dispatch table), SSO mobile
  login, shard ingest deps, uo-link socket backfill/connect, the bot slash-
  command dispatchers + discord manager, and the Shard/UserDetail/HeroEditor/
  CharacterStats React components.
- S4624 (34, nested template literals): pull inner templates into locals /
  a withQs() helper; rewrite shardEvents.describe() as a formatter table.
- S3358 (35, nested ternaries): lift to if/else vars, lookup maps, small
  components, or guarded JSX expressions.
- S6479 (12, array-index React keys): key by stable content instead of index
  (two in-editor lists left as-is; index matches their by-index edit model).
- S6353 (6): [0-9]/[^0-9] -> \d/\D.  S125 (5): reword state-shape comments that
  parsed as code.  S3800/S3782 (botScore): JSDoc-type PATH_WEIGHTS tuples.
- S6481 (2): memoize Auth/Site context values (and SiteContext brand).
- S4144: dedupe HeroEditor upload handler into useImageUpload().
- S1126 (2), S6035, S5869 (redundant A-Z under /i), S5843 (town-name regex ->
  prefix list): assorted one-liners.

Co-Authored-By: Claude <noreply@anthropic.com>

server/src/blocks/validateBlocks.js

@@ -37,6 +37,62 @@ function validateBlocks(blocks) {
   return { valid: errors.length === 0, errors }
 }
 
+// Envelope: only the reserved keys, nothing smuggled at the top level.
+function checkEnvelope(block, path, errors) {
+  for (const key of Object.keys(block)) {
+    if (!RESERVED_KEYS.includes(key)) {
+      errors.push(`${path}.${key} is not an allowed top-level key`)
+    }
+  }
+}
+
+// id — stable, unique across the whole page (top-level and nested share one
+// namespace since ids are the future join point for revision history).
+function checkId(block, path, seenIds, errors) {
+  if (typeof block.id !== 'string' || !ID_RE.test(block.id)) {
+    errors.push(`${path}.id must be a short id string`)
+  } else if (seenIds.has(block.id)) {
+    errors.push(`${path}.id duplicates another block id (${block.id})`)
+  } else {
+    seenIds.add(block.id)
+  }
+}
+
+// Per-block prop schema from the registry (skipped when props isn't an object —
+// that's already reported separately).
+function checkPropSchema(def, props, path, errors) {
+  if (!def.schema || !props || typeof props !== 'object') return
+  let schemaErrors = []
+  try {
+    schemaErrors = def.schema(props) || []
+  } catch (err) {
+    schemaErrors = [`schema threw: ${err.message}`]
+  }
+  for (const e of schemaErrors) errors.push(`${path}.props.${e}`)
+}
+
+// Nesting: only container blocks may hold sub-blocks, capped at one level.
+function checkNesting(def, props, path, seenIds, errors, nested) {
+  if (nested) {
+    errors.push(`${path} is a container and may not be nested inside another container`)
+    return
+  }
+  for (const slot of def.containerSlots) {
+    const sub = props ? props[slot] : undefined
+    if (sub === undefined) continue // an empty slot is allowed
+    if (!Array.isArray(sub)) {
+      errors.push(`${path}.props.${slot} must be an array of blocks`)
+      continue
+    }
+    if (sub.length > MAX_SUBBLOCKS) {
+      errors.push(`${path}.props.${slot} may not exceed ${MAX_SUBBLOCKS} blocks`)
+    }
+    sub.forEach((child, j) => {
+      validateBlock(child, `${path}.props.${slot}[${j}]`, seenIds, errors, { nested: true })
+    })
+  }
+}
+
 /**
  * Validate one block envelope in place. `nested` = true when validating a
  * sub-block inside a container slot, which forbids further nesting.
@@ -47,22 +103,8 @@ function validateBlock(block, path, seenIds, errors, { nested }) {
     return
   }
 
-  // Envelope: only the reserved keys, nothing smuggled at the top level.
-  for (const key of Object.keys(block)) {
-    if (!RESERVED_KEYS.includes(key)) {
-      errors.push(`${path}.${key} is not an allowed top-level key`)
-    }
-  }
-
-  // id — stable, unique across the whole page (top-level and nested share one
-  // namespace since ids are the future join point for revision history).
-  if (typeof block.id !== 'string' || !ID_RE.test(block.id)) {
-    errors.push(`${path}.id must be a short id string`)
-  } else if (seenIds.has(block.id)) {
-    errors.push(`${path}.id duplicates another block id (${block.id})`)
-  } else {
-    seenIds.add(block.id)
-  }
+  checkEnvelope(block, path, errors)
+  checkId(block, path, seenIds, errors)
 
   // visible — optional in input, but if present must be a boolean.
   if (block.visible !== undefined && typeof block.visible !== 'boolean') {
@@ -82,38 +124,8 @@ function validateBlock(block, path, seenIds, errors, { nested }) {
     return // can't validate props or nesting without a definition
   }
 
-  // Per-block prop schema from the registry.
-  if (def.schema && props && typeof props === 'object') {
-    let schemaErrors = []
-    try {
-      schemaErrors = def.schema(props) || []
-    } catch (err) {
-      schemaErrors = [`schema threw: ${err.message}`]
-    }
-    for (const e of schemaErrors) errors.push(`${path}.props.${e}`)
-  }
-
-  // Nesting: only container blocks may hold sub-blocks, capped at one level.
-  if (def.container) {
-    if (nested) {
-      errors.push(`${path} is a container and may not be nested inside another container`)
-      return
-    }
-    for (const slot of def.containerSlots) {
-      const sub = props ? props[slot] : undefined
-      if (sub === undefined) continue // an empty slot is allowed
-      if (!Array.isArray(sub)) {
-        errors.push(`${path}.props.${slot} must be an array of blocks`)
-        continue
-      }
-      if (sub.length > MAX_SUBBLOCKS) {
-        errors.push(`${path}.props.${slot} may not exceed ${MAX_SUBBLOCKS} blocks`)
-      }
-      sub.forEach((child, j) => {
-        validateBlock(child, `${path}.props.${slot}[${j}]`, seenIds, errors, { nested: true })
-      })
-    }
-  }
+  checkPropSchema(def, props, path, errors)
+  if (def.container) checkNesting(def, props, path, seenIds, errors, nested)
 }
 
 module.exports = { validateBlocks, MAX_BLOCKS, MAX_SUBBLOCKS }