perf(*): bound list queries, batch fetches, harden media downloads

frontend/src/lib/api/custom-emoji.ts

@@ -9,10 +9,27 @@ export interface CustomEmojiAsset {
   url: string;
 }
 
+const MAX_CACHED = 500;
+
 const ready = new Map<string, CustomEmojiAsset>();
 const missing = new Set<string>();
 const inflight = new Map<string, Promise<CustomEmojiAsset | null>>();
 
+function remember(key: string, asset: CustomEmojiAsset) {
+  ready.set(key, asset);
+  while (ready.size > MAX_CACHED) {
+    const oldest = ready.keys().next();
+    if (oldest.done) {
+      return;
+    }
+    const stale = ready.get(oldest.value);
+    ready.delete(oldest.value);
+    if (stale) {
+      URL.revokeObjectURL(stale.url);
+    }
+  }
+}
+
 function authHeaders(): Record<string, string> {
   return auth.token ? { Authorization: `Bearer ${auth.token}` } : {};
 }
@@ -34,7 +51,7 @@ async function fetchEmoji(
   if (response.ok) {
     const blob = await response.blob();
     const asset = { url: URL.createObjectURL(blob), mime: blob.type };
-    ready.set(key, asset);
+    remember(key, asset);
     return asset;
   }
   if (response.status === 409 && retry) {