feat(admin): live redis kill-switch on tunnel actions, sortable columns + CSV export + bulk actions, Node 24 LTS

WS1: pin all Docker stages to node:24.16.0-alpine; add engines node>=20.
WS2: lib/redis.ts gains TTL-backed redisSet, redisDel, setTunnelActive (writes tunnel:active:<sub>=1/0 EX 30, TUNNEL_ACTIVE_TTL override, no-op without REDIS_URL); wired into tunnel active/delete/reassign routes.
WS3: sortable columns, CSV export routes (token excluded), and bulk actions (self-account guard) across users/tunnels/audit admin tables.

app/api/admin/tunnels/[id]/route.ts

@@ -3,7 +3,7 @@ import { requireAdminApi } from '@/lib/auth/admin-guard';
 import { getSupabaseAdmin } from '@/lib/supabase/admin';
 import { logAdminAction } from '@/lib/auth/audit';
 import { isUuid } from '@/lib/admin/validators';
-import { redisSet } from '@/lib/redis';
+import { setTunnelActive } from '@/lib/redis';
 import { jsonNoStore } from '@/lib/admin/response';
 
 export const runtime = 'nodejs';
@@ -36,14 +36,15 @@ export async function DELETE(
     return jsonNoStore({ error: 'tunnel not found' }, { status: 404 });
   }
 
-  // Best-effort live kill-switch.
-  await redisSet(`tunnel:active:${data.subdomain}`, '0');
+  // Best-effort live kill-switch: write "0" so any live connection on the
+  // freed subdomain drops within ~1s. No-op when REDIS_URL is unset.
+  const redisOk = await setTunnelActive(data.subdomain, false);
 
   await logAdminAction(auth.user, {
     action: 'tunnel.delete',
     target_type: 'tunnel',
     target_id: id,
-    details: { subdomain: data.subdomain },
+    details: { subdomain: data.subdomain, redis: redisOk },
   });
 
   return jsonNoStore({ ok: true });