#9530 improvement(release): harden favicons, sim links, and the extension from a pre-release audit

Summary

Pre-release audit of the favicon service, Sim Links, and the browser extension's Sim Links support. No release blockers were found; these changes close the gaps the audit did find.

Favicons

• An icon already cached is served free; otherwise the use case checks the caller's own provider-lookup budget (burst 120, 60/min) before resolving, so one user can't drive unbounded provider fetches or cache writes. Concurrent lookups of a host share one resolution via coalesceLocally. The route-level limit rises from 300 to 1200/min so large tables of sites render
• Cached icons are capped at 64 KB (was 256 KB); an entry cached under the old cap is treated as expired and looked up again rather than read as a miss
• The host walk always ends at the registrable domain (a.b.c.d.example.com now reaches example.com)
• Binary routes refuse a body-less status (204/205) as their first declared status, at definition time
• Note: a self-hosted install without Redis has no icon cache, so every uncached icon draws on the budget

Sim Links

• The typed query is passed to the destination as a string and applied with the URL search setter (a # can't start a fragment). It's read from Next's parsed params, since Next re-serializes every request's query before app code sees it
• Spaces around a typed name are dropped (no name can hold one), so sim/foo%20 resolves instead of offering a create that then conflicts
• An organization with Sim Links but neither Home nor Search is no longer redirected to workspace settings; the organization root falls back to Sim Links
• canBrowsePeople is navigation-only, so a failed flag or permission lookup now hides People inside the helper instead of failing the page (the layout's own catch is folded into it)
• The links table virtualizes rows and passes stable handlers to its memoized rows
• Copy: "Only the creator and admins can edit"; no-results scope says "every Sim link you can see"; docs note the Opens sort shows the 50 most opened

Extension

• Typed input: surrounding spaces, leading slashes and #fragments are dropped; the query is passed on as typed; a lone surrogate no longer throws on Enter
• A name containing a space (sim card prices) is a search, so it sends nothing to Sim; the 64-character name cap is one constant shared with the server via the protocol package
• A failed suggestions request (signed out, rate limited) isn't cached as "no links"; 220 ms debounce; code points XML forbids are stripped from suggestion text
• Suggestions are parsed tolerantly, so a field added later doesn't break installed extensions
• Version 0.1.2 (the staging build differs from 0.1.1); DESIGN.md, README and the manifest description disclose the address-bar lookup

Docs

• The People page is unpublished until the feature launches

Type of Change

• Improvement

Testing

• Targeted Vitest: lib/sim-links, lib/favicon, components/favicon, lib/people, lib/api/server/routes, app/o/[organizationId], proxy.test.ts: 661 passing, including red-first cases for query handling, name trimming, the registrable-domain walk, oversized cache refresh, shared lookups, and the binary status guard
• Extension type-check; lint, check:api-validation:strict, check:boundaries, check:client-boundary, check:source-conventions, check:utils, check:comment-hygiene, check:test-patterns, check:unused-exports

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)