Fix security, transaction, and badge issues from final review

- Validate file URLs against S3 prefix in messages route (Fix 1)
- Guard attachment hrefs with https:// check in QuestionThread and QuestionSplitView (Fix 2)
- Wrap message create + updatedAt bump in prisma.$transaction (Fix 3)
- Add questionsBadge count query to curator layout for admin branch (Fix 4)
- Fire-and-forget email sends with void Promise.all (Fix 5)
- Wrap req.json() calls in try/catch returning 400 on parse failure (Fix 6)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/components/questions/QuestionSplitView.tsx

@@ -295,7 +295,7 @@ export function QuestionSplitView({ currentUserId }: { currentUserId: string })
                         {msg.files.map((f) => (
                           <a
                             key={f.url}
-                            href={f.url}
+                            href={f.url.startsWith("https://") ? f.url : "#"}
                             target="_blank"
                             rel="noopener noreferrer"
                             className="flex items-center gap-1.5 text-xs px-2 py-1 rounded-sm"

src/components/questions/QuestionThread.tsx

@@ -146,7 +146,7 @@ export function QuestionThread({
                   {msg.files.map((f, i) => (
                     <a
                       key={i}
-                      href={f.url}
+                      href={f.url.startsWith("https://") ? f.url : "#"}
                       target="_blank"
                       rel="noreferrer"
                       className="flex items-center gap-1.5 text-xs px-2 py-1 rounded-sm"