feat(admin): live redis kill-switch on tunnel actions, sortable columns + CSV export + bulk actions, Node 24 LTS

WS1: pin all Docker stages to node:24.16.0-alpine; add engines node>=20.
WS2: lib/redis.ts gains TTL-backed redisSet, redisDel, setTunnelActive (writes tunnel:active:<sub>=1/0 EX 30, TUNNEL_ACTIVE_TTL override, no-op without REDIS_URL); wired into tunnel active/delete/reassign routes.
WS3: sortable columns, CSV export routes (token excluded), and bulk actions (self-account guard) across users/tunnels/audit admin tables.

app/globals.css

@@ -365,3 +365,66 @@ button:disabled,
 select {
   font-size: 1rem;
 }
+
+/* Sortable table headers */
+.th-sort {
+  cursor: pointer;
+  user-select: none;
+  white-space: nowrap;
+}
+.th-sort:hover {
+  color: var(--fg);
+}
+.th-sort .sort-ind {
+  margin-left: 0.3rem;
+  opacity: 0.5;
+  font-size: 0.7rem;
+}
+.th-sort.sorted .sort-ind {
+  opacity: 1;
+  color: var(--accent);
+}
+
+/* Checkbox / selection column */
+.admin-table th.col-check,
+.admin-table td.col-check {
+  width: 1%;
+  white-space: nowrap;
+  text-align: center;
+}
+.admin-table input[type='checkbox'] {
+  width: auto;
+  margin: 0;
+  cursor: pointer;
+  accent-color: var(--accent);
+}
+.admin-table tr.row-selected td {
+  background: rgba(59, 130, 246, 0.08);
+}
+
+/* Bulk action bar */
+.bulk-bar {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+  flex-wrap: wrap;
+  margin: 0 0 1rem;
+  padding: 0.6rem 0.85rem;
+  background: var(--card);
+  border: 1px solid var(--accent);
+  border-radius: 8px;
+}
+.bulk-bar .bulk-count {
+  font-weight: 600;
+  margin-right: 0.25rem;
+}
+.bulk-bar .spacer {
+  flex: 1 1 auto;
+}
+
+.toolbar-actions {
+  margin-left: auto;
+  display: flex;
+  gap: 0.5rem;
+}
+