Merge origin/main into moderator-app-pages

Brings the branch up to date with main (321 commits), incl. the canonical
@civitai/shared package. Conflict resolutions:
- @civitai/shared: took main's canonical package (browsing-levels + flags + index);
  the spoke keeps its allBrowsingLevelsFlag import (now main's Blocked-excluding
  semantics), per instruction.
- next.config.mjs: serverExternalPackages took main's (adds @pyroscope/nodejs +
  @datadog/pprof); the auto-merged transpilePackages keeps both sides.
- image.controller.ts + routers/moderator/index.ts: kept main's added imports.
- pnpm-lock.yaml: regenerated via pnpm install against the merged package.json.

Verified: main app `tsc --noEmit` exit 0; spoke `svelte-check` 0 errors.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.env-example

@@ -129,6 +129,13 @@ NEXT_PUBLIC_SEARCH_CLIENT_KEY=meilisearch
 METRICS_SEARCH_HOST=http://localhost:7700
 METRICS_SEARCH_API_KEY=meilisearch
 
+# Debounce window (ms) for flushing model-metric-affected ids into the model
+# search-index update queue. Widening it collapses more of a hot model's repeated
+# metric changes into a single reindex (cost: metric/popularity staleness lags by
+# up to the window). Fail-soft: a bad value falls back to the 45m default. Requires
+# a restart/rollout to take effect. Default 45m.
+# SEARCH_INDEX_MODEL_METRIC_FLUSH_INTERVAL_MS=2700000
+
 # Per-call Meilisearch timeout in ms. Calls wrapped via withMeili() fail fast
 # with MeiliCallTimeoutError once exceeded, instead of hanging until Traefik's
 # 30s router timeout fires.