chore(quality): resolve SonarQube code smells across website

Clears the 124 CODE_SMELL findings from the SonarQube scan (server, client,
and bot). All changes are behaviour-preserving refactors — no route, protocol,
schema, or config changes — verified against the full server (381) and client
(43) test suites plus a clean client build.

By rule:
- S3776 (20, cognitive complexity): extract helpers/handlers so each function
  drops under the threshold — shard model upsert builders, page/wiki update,
  block validation, notification stream mapping (dispatch table), SSO mobile
  login, shard ingest deps, uo-link socket backfill/connect, the bot slash-
  command dispatchers + discord manager, and the Shard/UserDetail/HeroEditor/
  CharacterStats React components.
- S4624 (34, nested template literals): pull inner templates into locals /
  a withQs() helper; rewrite shardEvents.describe() as a formatter table.
- S3358 (35, nested ternaries): lift to if/else vars, lookup maps, small
  components, or guarded JSX expressions.
- S6479 (12, array-index React keys): key by stable content instead of index
  (two in-editor lists left as-is; index matches their by-index edit model).
- S6353 (6): [0-9]/[^0-9] -> \d/\D.  S125 (5): reword state-shape comments that
  parsed as code.  S3800/S3782 (botScore): JSDoc-type PATH_WEIGHTS tuples.
- S6481 (2): memoize Auth/Site context values (and SiteContext brand).
- S4144: dedupe HeroEditor upload handler into useImageUpload().
- S1126 (2), S6035, S5869 (redundant A-Z under /i), S5843 (town-name regex ->
  prefix list): assorted one-liners.

Co-Authored-By: Claude <noreply@anthropic.com>

server/src/router/v1/admin/admin.routes.js

@@ -1113,7 +1113,7 @@ adminRouter.get(
   // #swagger.tags = ['Admin · Moderation']
   // #swagger.summary = 'Per-user moderation summary (counts, latest tag, linked account)'
   // #swagger.security = [{ "cookieAuth": [] }, { "bearerAuth": [] }]
-  param('discordId').matches(/^[0-9]{1,32}$/),
+  param('discordId').matches(/^d{1,32}$/),
   validate,
   moderation.getUser,
 )
@@ -1122,7 +1122,7 @@ adminRouter.get(
   // #swagger.tags = ['Admin · Moderation']
   // #swagger.summary = 'Full moderation action history for a user'
   // #swagger.security = [{ "cookieAuth": [] }, { "bearerAuth": [] }]
-  param('discordId').matches(/^[0-9]{1,32}$/),
+  param('discordId').matches(/^d{1,32}$/),
   validate,
   moderation.getUserActions,
 )
@@ -1131,7 +1131,7 @@ adminRouter.get(
   // #swagger.tags = ['Admin · Moderation']
   // #swagger.summary = 'Staff notes for a user (admin_only notes hidden from moderators)'
   // #swagger.security = [{ "cookieAuth": [] }, { "bearerAuth": [] }]
-  param('discordId').matches(/^[0-9]{1,32}$/),
+  param('discordId').matches(/^d{1,32}$/),
   validate,
   moderation.getUserNotes,
 )
@@ -1140,7 +1140,7 @@ adminRouter.post(
   // #swagger.tags = ['Admin · Moderation']
   // #swagger.summary = 'Add a staff note (admin_only visibility requires the admin role)'
   // #swagger.security = [{ "cookieAuth": [] }, { "bearerAuth": [] }]
-  param('discordId').matches(/^[0-9]{1,32}$/),
+  param('discordId').matches(/^d{1,32}$/),
   body('body').isString().trim().isLength({ min: 1, max: 4000 }),
   body('visibility').optional().isIn(['staff_only', 'admin_only']),
   validate,
@@ -1209,7 +1209,7 @@ adminRouter.get(
   // #swagger.security = [{ "cookieAuth": [] }, { "bearerAuth": [] }]
   // #swagger.parameters['discordId'] = { in: 'path', required: true, schema: { type: 'string' }, description: 'Discord snowflake.' }
   /* #swagger.responses[200] = { description: 'Appeals for the user', content: { "application/json": { schema: { type: "array", items: { $ref: "#/components/schemas/AppealQueueItem" } } } } } */
-  param('discordId').matches(/^[0-9]{1,32}$/),
+  param('discordId').matches(/^d{1,32}$/),
   validate,
   moderation.getUserAppeals,
 )

server/src/router/v1/admin/discordBot.controller.js

@@ -26,8 +26,7 @@ async function isValidBotToken(token) {
     const res = await fetch('https://discord.com/api/users/@me', {
       headers: { Authorization: `Bot ${token}` },
     })
-    if (res.status === 401) return false
-    return true
+    return res.status !== 401
   } catch (err) {
     log.warn('discord token validation unreachable — not blocking save', { message: err.message })
     return true