chore(quality): resolve SonarQube code smells across website

Clears the 124 CODE_SMELL findings from the SonarQube scan (server, client,
and bot). All changes are behaviour-preserving refactors — no route, protocol,
schema, or config changes — verified against the full server (381) and client
(43) test suites plus a clean client build.

By rule:
- S3776 (20, cognitive complexity): extract helpers/handlers so each function
  drops under the threshold — shard model upsert builders, page/wiki update,
  block validation, notification stream mapping (dispatch table), SSO mobile
  login, shard ingest deps, uo-link socket backfill/connect, the bot slash-
  command dispatchers + discord manager, and the Shard/UserDetail/HeroEditor/
  CharacterStats React components.
- S4624 (34, nested template literals): pull inner templates into locals /
  a withQs() helper; rewrite shardEvents.describe() as a formatter table.
- S3358 (35, nested ternaries): lift to if/else vars, lookup maps, small
  components, or guarded JSX expressions.
- S6479 (12, array-index React keys): key by stable content instead of index
  (two in-editor lists left as-is; index matches their by-index edit model).
- S6353 (6): [0-9]/[^0-9] -> \d/\D.  S125 (5): reword state-shape comments that
  parsed as code.  S3800/S3782 (botScore): JSDoc-type PATH_WEIGHTS tuples.
- S6481 (2): memoize Auth/Site context values (and SiteContext brand).
- S4144: dedupe HeroEditor upload handler into useImageUpload().
- S1126 (2), S6035, S5869 (redundant A-Z under /i), S5843 (town-name regex ->
  prefix list): assorted one-liners.

Co-Authored-By: Claude <noreply@anthropic.com>

server/src/config/notificationStreams.js

@@ -92,6 +92,60 @@ function createTracker() {
 }
 const defaultTracker = createTracker()
 
+// Per-kind mappers, each pushing 0+ targets onto `out` (and updating `tracker`
+// for the upsert-transition kinds). Split out of mapShardEvent so that function
+// stays a trivial dispatch + the public-safety filter.
+const serverStatusUp = (event, tracker, out) =>
+  out.push({ streamId: 'server.status', ref: `up:${event.bootId || ''}` })
+const serverStatusDown = (event, tracker, out) => out.push({ streamId: 'server.status', ref: 'down' })
+
+const EVENT_MAPPERS = {
+  'server.hello': serverStatusUp,
+  'server.shutdown': serverStatusDown,
+  'server.crashed': serverStatusDown,
+  'house.decay': (event, tracker, out) => {
+    if (String(event.to).toUpperCase() !== 'IDOC') return
+    const ref = String(event.serial ?? '')
+    out.push({ streamId: 'idoc.warning', ref }) // public — location only
+    if (event.ownerAcct) {
+      out.push({ streamId: 'house.idoc', ref, ownerAccount: event.ownerAcct }) // personal
+    }
+  },
+  'champ.update': (event, tracker, out) => {
+    const { serial } = event
+    if (serial == null) return
+    const wasActive = tracker.champActive.get(serial) === true
+    const isActive = event.active === true
+    tracker.champActive.set(serial, isActive)
+    if (isActive && !wasActive) out.push({ streamId: 'champ.start', ref: String(serial) })
+  },
+  'champ.remove': (event, tracker) => {
+    if (event.serial != null) tracker.champActive.delete(event.serial)
+  },
+  'city.update': (event, tracker, out) => {
+    const { city } = event
+    if (!city) return
+    const gov = event.governor && event.governor.serial != null ? String(event.governor.serial) : null
+    const prev = tracker.cityGovernor.get(city)
+    tracker.cityGovernor.set(city, gov)
+    // Only a real transition to a new governor, and never on first sight
+    // (prev === undefined) so a reconnect snapshot isn't read as an election.
+    if (prev !== undefined && gov && gov !== prev) {
+      out.push({ streamId: 'governor.election', ref: String(city) })
+    }
+  },
+  'vendor.sale': (event, tracker, out) => {
+    if (event.ownerAcct) {
+      out.push({ streamId: 'vendor.sale', ref: String(event.t ?? ''), ownerAccount: event.ownerAcct })
+    }
+  },
+  'account.login.attempt': (event, tracker, out) => {
+    if (event.acct) {
+      out.push({ streamId: 'account.login', ref: String(event.t ?? ''), ownerAccount: event.acct })
+    }
+  },
+}
+
 // Map one shard event → an array of targets ({ streamId, ref, ownerAccount? }).
 // May yield 0, 1, or 2 targets (an owner house.decay produces both the public
 // idoc.warning and the personal house.idoc). Pure given `tracker`.
@@ -100,61 +154,8 @@ function mapShardEvent(event, tracker = defaultTracker) {
   const kind = event.kind
   const out = []
 
-  switch (kind) {
-    case 'server.hello':
-      out.push({ streamId: 'server.status', ref: `up:${event.bootId || ''}` })
-      break
-    case 'server.shutdown':
-    case 'server.crashed':
-      out.push({ streamId: 'server.status', ref: 'down' })
-      break
-    case 'house.decay': {
-      if (String(event.to).toUpperCase() !== 'IDOC') break
-      const ref = String(event.serial ?? '')
-      out.push({ streamId: 'idoc.warning', ref }) // public — location only
-      if (event.ownerAcct) {
-        out.push({ streamId: 'house.idoc', ref, ownerAccount: event.ownerAcct }) // personal
-      }
-      break
-    }
-    case 'champ.update': {
-      const { serial } = event
-      if (serial == null) break
-      const wasActive = tracker.champActive.get(serial) === true
-      const isActive = event.active === true
-      tracker.champActive.set(serial, isActive)
-      if (isActive && !wasActive) out.push({ streamId: 'champ.start', ref: String(serial) })
-      break
-    }
-    case 'champ.remove':
-      if (event.serial != null) tracker.champActive.delete(event.serial)
-      break
-    case 'city.update': {
-      const { city } = event
-      if (!city) break
-      const gov = event.governor && event.governor.serial != null ? String(event.governor.serial) : null
-      const prev = tracker.cityGovernor.get(city)
-      tracker.cityGovernor.set(city, gov)
-      // Only a real transition to a new governor, and never on first sight
-      // (prev === undefined) so a reconnect snapshot isn't read as an election.
-      if (prev !== undefined && gov && gov !== prev) {
-        out.push({ streamId: 'governor.election', ref: String(city) })
-      }
-      break
-    }
-    case 'vendor.sale':
-      if (event.ownerAcct) {
-        out.push({ streamId: 'vendor.sale', ref: String(event.t ?? ''), ownerAccount: event.ownerAcct })
-      }
-      break
-    case 'account.login.attempt':
-      if (event.acct) {
-        out.push({ streamId: 'account.login', ref: String(event.t ?? ''), ownerAccount: event.acct })
-      }
-      break
-    default:
-      break
-  }
+  const mapper = EVENT_MAPPERS[kind]
+  if (mapper) mapper(event, tracker, out)
 
   // Defense in depth: a PUBLIC (non-personal) target may only ride a public-safe
   // kind. Personal targets are owner-keyed and delivered solely to the owner, so