arch audit phase 2: reliability and perf fixes

Created by: jedmund

Summary

Phase 2 of the architecture audit — three self-contained reliability/perf fixes.

• A-5 · Add @@index([status, postType]) on Post and @@index([isPhotography]) on Media. Covers the filter combos used by /api/posts list (status + type) and the isPhotography filter on Media. Migration 20260420000000_add_composite_indexes included — run prisma migrate deploy to apply.
• A-8 · New src/lib/server/env.ts validates ADMIN_SESSION_SECRET, ADMIN_PASSWORD, REDIS_URL, DATABASE_URL at import time. Boot fails fast in prod if any are missing; dev warns on ADMIN_PASSWORD/REDIS_URL and falls back. Wired into hooks.server.ts, admin/session.ts, and redis-client.ts.
• A-11 · Replace include: { tags: { include: { tag: … } } } with nested select in /api/posts, /api/posts/[id], and /api/universe. Skips the 4 unused PostTag join-row columns; detail endpoint also narrows Tag fields to {id, name, displayName, slug} (no consumer reads description/createdAt/updatedAt).

A-13 (script Prisma leaks) was audited — every script using Prisma already calls $disconnect() in a finally. No code change needed.

Test plan

• pnpm check — baseline 116 errors / 9 warnings, no new ones introduced
• pnpm exec prisma migrate deploy applies the new indexes
• Boot with ADMIN_SESSION_SECRET unset → process exits with "Missing required environment variables"
• Posts list and detail responses still include tags: [{ tag: {...} }] shape (admin edit page depends on this)
• EXPLAIN on SELECT * FROM "Post" WHERE status = 'published' AND "postType" = 'post' uses Post_status_postType_idx