sync: add AI review pipeline, parallel skill-files fetch, Redis cache improvements

- feat(review): add skill_reviews table, review API endpoints (pending/submit/stats), admin auth
- perf: parallel file fetching in skill-files API (was sequential → timeout)
- fix: handle Date serialization from Redis cache
- fix: align curation batch scripts with current browseReadyFilter

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/web/app/api/review/pending/route.ts

@@ -0,0 +1,142 @@
+import { type NextRequest, NextResponse } from 'next/server';
+import { createDb, skillReviewQueries } from '@skillhub/db';
+import { requireAdmin } from '@/lib/admin-auth';
+import { withRateLimit, createRateLimitResponse, createRateLimitHeaders } from '@/lib/rate-limit';
+
+export const maxDuration = 60; // seconds — queries 55K+ skills with owner-cap logic
+
+const db = createDb();
+
+/**
+ * GET /api/review/pending
+ * Returns a batch of skills ready for AI review.
+ * Supports owner-capped batches for diversity and hybrid re-review/new-review mixing.
+ *
+ * Query params:
+ *   batch_size   - number of skills to return (default 20, max 50)
+ *   offset       - number of skills to skip for pagination (default 0)
+ *   min_quality  - minimum quality_score (default 50)
+ *   security     - security_status filter (default "pass")
+ *   priority     - "re-review" to show needs-re-review first, "re-review-all" to include already ai-reviewed skills
+ *   owner_limit  - max skills per github_owner in batch (default 0=unlimited, max 10)
+ */
+export async function GET(request: NextRequest) {
+  // Rate limiting
+  const rateLimitResult = await withRateLimit(request, 'anonymous');
+  if (!rateLimitResult.allowed) {
+    return createRateLimitResponse(rateLimitResult);
+  }
+
+  // Admin check (supports API key auth via Authorization header)
+  const adminCheck = await requireAdmin(request);
+  if (!adminCheck.authorized) {
+    return adminCheck.response;
+  }
+
+  try {
+    const { searchParams } = new URL(request.url);
+    const batchSize = Math.min(
+      Math.max(parseInt(searchParams.get('batch_size') ?? '20', 10) || 20, 1),
+      50
+    );
+    const offset = Math.max(parseInt(searchParams.get('offset') ?? '0', 10) || 0, 0);
+    const minQuality = parseInt(searchParams.get('min_quality') ?? '50', 10) || 50;
+    const securityPass = searchParams.get('security') !== 'any';
+    const priorityParam = searchParams.get('priority') ?? '';
+    const priorityReReview = priorityParam === 're-review';
+    const reReviewAll = priorityParam === 're-review-all';
+    const ownerLimit = Math.min(
+      Math.max(parseInt(searchParams.get('owner_limit') ?? '0', 10) || 0, 0),
+      10
+    );
+
+    // Run counts in parallel
+    const [totalPending, reReviews] = await Promise.all([
+      skillReviewQueries.countPending(db, { minQuality, securityPass }),
+      skillReviewQueries.countReReviews(db),
+    ]);
+
+    // Re-review-all mode: skip hybrid mixing, just fetch all reviewable skills
+    let batch: Array<{ id: string; githubOwner?: string; github_owner?: string; [key: string]: unknown }> = [];
+
+    if (reReviewAll) {
+      const extraSlots = ownerLimit > 0 ? Math.min(batchSize, 10) : 0;
+      const allBatch = await skillReviewQueries.getPending(db, {
+        batchSize: batchSize + extraSlots,
+        offset,
+        minQuality,
+        securityPass,
+        reReviewAll: true,
+        ownerLimit,
+      }) as typeof batch;
+      batch = [...allBatch].slice(0, batchSize);
+    } else {
+      // Normal mode: Hybrid batch — mix re-reviews (up to 5) with new reviews
+      const reReviewSlots = Math.min(5, reReviews, batchSize);
+
+      if (reReviewSlots > 0 && !priorityReReview) {
+        // Fetch re-reviews first (up to 5)
+        const reReviewBatch = await skillReviewQueries.getPending(db, {
+          batchSize: reReviewSlots,
+          minQuality: 0, // re-reviews regardless of quality
+          securityPass,
+          priorityReReview: true,
+          ownerLimit,
+        });
+        batch = [...reReviewBatch] as typeof batch;
+      }
+
+      // Fill remaining slots with new reviews (or all slots if priority=re-review)
+      const remainingSlots = batchSize - batch.length;
+      if (remainingSlots > 0) {
+        // Request extra to compensate for owner deduplication
+        const extraSlots = ownerLimit > 0 ? Math.min(remainingSlots, 10) : 0;
+        const newBatch = await skillReviewQueries.getPending(db, {
+          batchSize: priorityReReview ? batchSize : (remainingSlots + extraSlots),
+          offset,
+          minQuality,
+          securityPass,
+          priorityReReview,
+          ownerLimit,
+        }) as typeof batch;
+
+        if (priorityReReview) {
+          batch = [...newBatch];
+        } else if (ownerLimit > 0 && batch.length > 0) {
+          // Deduplicate owners: count per-owner across both batches
+          const ownerCounts: Record<string, number> = {};
+          for (const s of batch) {
+            const owner = (s.githubOwner ?? s.github_owner ?? 'unknown') as string;
+            ownerCounts[owner] = (ownerCounts[owner] || 0) + 1;
+          }
+          for (const s of newBatch) {
+            const owner = (s.githubOwner ?? s.github_owner ?? 'unknown') as string;
+            if ((ownerCounts[owner] || 0) >= ownerLimit) continue; // Skip — owner already at cap
+            ownerCounts[owner] = (ownerCounts[owner] || 0) + 1;
+            batch.push(s);
+            if (batch.length >= batchSize) break;
+          }
+        } else {
+          batch = [...batch, ...newBatch].slice(0, batchSize);
+        }
+      }
+    }
+
+    return NextResponse.json(
+      {
+        total_pending: totalPending,
+        re_reviews: reReviews,
+        batch,
+      },
+      {
+        headers: createRateLimitHeaders(rateLimitResult),
+      }
+    );
+  } catch (error) {
+    console.error('[Review] Error fetching pending:', error);
+    return NextResponse.json(
+      { error: 'Failed to fetch pending reviews' },
+      { status: 500 }
+    );
+  }
+}