fix(web): reject stale Server Action POSTs in middleware (real fix)

Replaces the console.error filter (which only hid the log noise) with
middleware that short-circuits the requests causing the leak in the
first place. Any POST carrying a Next-Action header against this bundle
is by definition stale — no `use server` directives exist in the
codebase, so the action ID can only have come from a previously deployed
build cached on the client or replayed by bots.

Returning 410 Gone before the request reaches Next's internal handler
prevents the InvariantError path that was retaining per-request RSS
under bot pressure (memory climbed 100MB → 1.35GB in ~13h on
threatcrush.com on 2026-05-12 before this).

Deletes apps/web/instrumentation.ts — it existed only to host the
console.error suppression added in 14f9816, and Sentry instrumentation
was already gone.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ralyodio

apps/web/instrumentation.ts

@@ -0,0 +1,19 @@
+import { NextResponse } from "next/server";
+import type { NextRequest } from "next/server";
+
+// Any request carrying a Next-Action header is a Server Action invocation.
+// The current bundle defines no Server Actions, so every such request is a
+// stale-bundle hit (cached clients or bots replaying old action IDs). Letting
+// these reach Next's internal handler triggers an InvariantError on every hit
+// and leaks RSS under sustained load. Reject with 410 Gone before any of that
+// runs; the client framework treats a non-RSC response as a signal to reload.
+export function middleware(req: NextRequest): NextResponse | undefined {
+  if (req.headers.get("next-action")) {
+    return new NextResponse(null, { status: 410 });
+  }
+  return undefined;
+}
+
+export const config = {
+  matcher: "/((?!_next/static|_next/image|favicon.ico).*)",
+};