fix(admin): eliminate GoTrue empty-body 500s under bulk load (retry-all + undici keep-alive + sequential bulk), CSV formula-injection guard

app/api/admin/users/[id]/ban/route.ts

@@ -1,6 +1,7 @@
 import { type NextRequest } from 'next/server';
 import { requireAdminApi } from '@/lib/auth/admin-guard';
 import { getSupabaseAdmin } from '@/lib/supabase/admin';
+import { withAdminRetry } from '@/lib/admin/retry';
 import { logAdminAction } from '@/lib/auth/audit';
 import { isUuid, parseBoolean } from '@/lib/admin/validators';
 import { jsonNoStore } from '@/lib/admin/response';
@@ -44,9 +45,14 @@ export async function POST(
   }
 
   const admin = getSupabaseAdmin();
-  const { error } = await admin.auth.admin.updateUserById(id, {
-    ban_duration: banned ? BAN_DURATION : 'none',
-  } as { ban_duration: string });
+  // Retry transient empty-body / poisoned-keep-alive failures so a burst-load
+  // ban/unban doesn't 500. `updateUserById` is idempotent for our use
+  // (ban_duration set to the same value), so a retry is safe.
+  const { error } = await withAdminRetry(() =>
+    admin.auth.admin.updateUserById(id, {
+      ban_duration: banned ? BAN_DURATION : 'none',
+    } as { ban_duration: string }),
+  );
   if (error) {
     console.error('admin user.ban failed', error);
     return jsonNoStore({ error: 'internal error' }, { status: 500 });