feat(admin): live redis kill-switch on tunnel actions, sortable columns + CSV export + bulk actions, Node 24 LTS

WS1: pin all Docker stages to node:24.16.0-alpine; add engines node>=20.
WS2: lib/redis.ts gains TTL-backed redisSet, redisDel, setTunnelActive (writes tunnel:active:<sub>=1/0 EX 30, TUNNEL_ACTIVE_TTL override, no-op without REDIS_URL); wired into tunnel active/delete/reassign routes.
WS3: sortable columns, CSV export routes (token excluded), and bulk actions (self-account guard) across users/tunnels/audit admin tables.

app/api/admin/tunnels/[id]/reassign/route.ts

@@ -5,6 +5,7 @@ import { logAdminAction } from '@/lib/auth/audit';
 import { isUuid } from '@/lib/admin/validators';
 import { validateSubdomain } from '@/lib/validation';
 import { isSubdomainReserved } from '@/lib/admin/reserved';
+import { setTunnelActive } from '@/lib/redis';
 import { jsonNoStore } from '@/lib/admin/response';
 
 export const runtime = 'nodejs';
@@ -49,13 +50,22 @@ export async function POST(
   // Reject if taken by a different tunnel (keyed by owner user_id).
   const { data: existing } = await admin
     .from('tunnels')
-    .select('user_id')
+    .select('user_id, subdomain')
     .eq('subdomain', subdomain)
-    .maybeSingle<{ user_id: string }>();
+    .maybeSingle<{ user_id: string; subdomain: string }>();
   if (existing && existing.user_id !== id) {
     return jsonNoStore({ error: 'subdomain taken' }, { status: 409 });
   }
 
+  // Capture the current subdomain so we can drop the OLD hostname's live
+  // connection once it is freed by the rename.
+  const { data: current } = await admin
+    .from('tunnels')
+    .select('subdomain')
+    .eq('user_id', id)
+    .maybeSingle<{ subdomain: string }>();
+  const oldSubdomain = current?.subdomain ?? null;
+
   const { data, error } = await admin
     .from('tunnels')
     .update({ subdomain })
@@ -74,11 +84,17 @@ export async function POST(
     return jsonNoStore({ error: 'tunnel not found' }, { status: 404 });
   }
 
+  // Best-effort: drop any live connection on the OLD subdomain so the former
+  // hostname stops resolving as active. No-op when REDIS_URL is unset.
+  if (oldSubdomain && oldSubdomain !== subdomain) {
+    await setTunnelActive(oldSubdomain, false);
+  }
+
   await logAdminAction(auth.user, {
     action: 'tunnel.reassign',
     target_type: 'tunnel',
     target_id: id,
-    details: { subdomain },
+    details: { subdomain, previous_subdomain: oldSubdomain },
   });
 
   return jsonNoStore({ ok: true, subdomain });