chore(quality): resolve SonarQube code smells across website

Clears the 124 CODE_SMELL findings from the SonarQube scan (server, client,
and bot). All changes are behaviour-preserving refactors — no route, protocol,
schema, or config changes — verified against the full server (381) and client
(43) test suites plus a clean client build.

By rule:
- S3776 (20, cognitive complexity): extract helpers/handlers so each function
  drops under the threshold — shard model upsert builders, page/wiki update,
  block validation, notification stream mapping (dispatch table), SSO mobile
  login, shard ingest deps, uo-link socket backfill/connect, the bot slash-
  command dispatchers + discord manager, and the Shard/UserDetail/HeroEditor/
  CharacterStats React components.
- S4624 (34, nested template literals): pull inner templates into locals /
  a withQs() helper; rewrite shardEvents.describe() as a formatter table.
- S3358 (35, nested ternaries): lift to if/else vars, lookup maps, small
  components, or guarded JSX expressions.
- S6479 (12, array-index React keys): key by stable content instead of index
  (two in-editor lists left as-is; index matches their by-index edit model).
- S6353 (6): [0-9]/[^0-9] -> \d/\D.  S125 (5): reword state-shape comments that
  parsed as code.  S3800/S3782 (botScore): JSDoc-type PATH_WEIGHTS tuples.
- S6481 (2): memoize Auth/Site context values (and SiteContext brand).
- S4144: dedupe HeroEditor upload handler into useImageUpload().
- S1126 (2), S6035, S5869 (redundant A-Z under /i), S5843 (town-name regex ->
  prefix list): assorted one-liners.

Co-Authored-By: Claude <noreply@anthropic.com>

server/src/router/v1/auth/sso.controller.js

@@ -321,31 +321,58 @@ async function mintMobileAuthLink(req, sess, user, providerId, viaTotp) {
 // code and 302s to the app callback instead of setting a session cookie. A 2FA
 // account is routed through the same web TOTP form (carrying the bridge session)
 // and completes in finishSsoTotp — the second factor is never bypassed.
-async function finishMobileLogin(req, res, providerId, kind, tx, profile) {
+// Validate the mobile bridge session. Returns the session, or sends the failure
+// response (redirect when we still have a session for its redirect_uri, else a
+// generic 400) and returns null so the caller stops.
+async function requireValidBridgeSession(res, tx, providerId) {
   const sess = await mobileBridge.getSession(tx.mobileSessionId)
-  if (!sess || sess.status !== 'pending' || new Date(sess.expires_at).getTime() <= Date.now()) {
-    log.warn('mobile sso callback: bridge session invalid/expired', { provider: providerId })
-    // Without a valid session we can't trust a redirect_uri — fail generically.
-    if (sess) return res.redirect(appError(sess, 'session_expired'))
-    return res
-      .status(400)
-      .json({ message: 'This sign-in session is invalid or has expired. Please try again from the app.' })
+  const invalid = !sess || sess.status !== 'pending' || new Date(sess.expires_at).getTime() <= Date.now()
+  if (!invalid) return sess
+  log.warn('mobile sso callback: bridge session invalid/expired', { provider: providerId })
+  // Without a valid session we can't trust a redirect_uri — fail generically.
+  if (sess) {
+    res.redirect(appError(sess, 'session_expired'))
+    return null
   }
+  res
+    .status(400)
+    .json({ message: 'This sign-in session is invalid or has expired. Please try again from the app.' })
+  return null
+}
 
-  let user
+// Resolve the linked user for a mobile SSO login (link-only, with opt-in
+// provisioning when registration mode allows it). On refusal, sends the redirect
+// and returns null.
+async function resolveMobileSsoUser(req, res, sess, providerId, profile) {
   const identity = await userIdentities.findByProviderSubject(providerId, profile.subject)
   if (identity) {
-    user = await users.getById(identity.user_id)
-    if (!user) return res.redirect(appError(sess, 'not_linked'))
-  } else {
-    const mode = await settings.getRegistrationMode()
-    if (mode !== 'sso' && mode !== 'both') {
-      log.warn('mobile sso login refused: no linked account', { provider: providerId })
-      return res.redirect(appError(sess, 'not_linked'))
+    const user = await users.getById(identity.user_id)
+    if (!user) {
+      res.redirect(appError(sess, 'not_linked'))
+      return null
     }
-    user = await provisionSsoPlayer(req, providerId, profile)
-    if (!user) return res.redirect(appError(sess, 'error'))
+    return user
   }
+  const mode = await settings.getRegistrationMode()
+  if (mode !== 'sso' && mode !== 'both') {
+    log.warn('mobile sso login refused: no linked account', { provider: providerId })
+    res.redirect(appError(sess, 'not_linked'))
+    return null
+  }
+  const user = await provisionSsoPlayer(req, providerId, profile)
+  if (!user) {
+    res.redirect(appError(sess, 'error'))
+    return null
+  }
+  return user
+}
+
+async function finishMobileLogin(req, res, providerId, kind, tx, profile) {
+  const sess = await requireValidBridgeSession(res, tx, providerId)
+  if (!sess) return
+
+  const user = await resolveMobileSsoUser(req, res, sess, providerId, profile)
+  if (!user) return
 
   if (user.status && user.status !== 'active') {
     log.warn('mobile sso login refused: inactive account', { provider: providerId, id: user.id, status: user.status })