[Rushaway]

Fixes #84.

What was wrong

Ban list. The filter form always submits searchText=, so every Apply goes through the search branch. Its WHERE was A OR B OR C OR D AND <filters> with no parentheses, so the server, time, status-chip and Hide-inactive predicates only bound the reason arm. The empty search ('%%') matched every row through the other arms, so all of them were no-ops. The commslist got this parentheses fix in sbpp#1274; the banlist never did.

Comm blocks. ?server= / ?time= only pre-selected the dropdowns. No query read them.

Changes

• page.banlist.php: wrap the search OR group in parentheses in both the list and count queries.
• page.commslist.php: build server / time into the same predicate block as the ?type= chip, using the banlist's $publicFilterAnd / $publicFilterWheren / $publicFilterArgs / $publicFilterLink shape. Apply it in all three branches (search, no search, advSearch). Carry it in $searchlink so pagination and the Hide-inactive toggle keep it. The no-search count query now aliases the table as CO, so one suffix serves both queries.
• page.commslist.php advSearch: when $where is empty and Hide inactive is on, the query used to end in a bare AND (…) with no WHERE (SQL 1064). That can happen with an unknown advType, or with advType=admin for a visitor when admin names are hidden. Hide inactive now becomes the WHERE.
• $filters on the commslist reports the sanitised server/time values, like the banlist.
• New web/tests/integration/PublicListFilterBarTest.php (9 tests). It reads the View's ban_list, total_bans and searchlink through a capturing stub Smarty, so it checks the list query, the count query and link preservation.
• AGENTS.md "Where to find what" row; CHANGELOG 2.2.8-srcdslab (2.2.6 / 2.2.7 are taken by perf: set the database charset once per connection in sbpp_main #82 / fix(sql): async-safe comms queue, keep DB across maps, index-friendly SteamID lookups #83). No template change, so no theme_version bump.

Verification

• New test: 9/9 pass. Against origin/main's handlers it fails 9/9: 8 wrong row sets plus the SQL 1064.
• Every PHPUnit class that renders either handler (BanListStateFilter, PublicBanListRegression, Banlist/CommslistQueryCount, BanListIpColumn, BanlistCommentsVisibility, BanlistRemovedByConsole, PunishmentHistoryChip, Php82Deprecations, Routing, ToastEmitRegression, DeadJsCallSites, HomeDashboardLatestBansLink, SteamIdConversion): 167/167.
• PHPStan (level 5 + dba): no errors in the changed files. The only 3 errors are in includes/Auth/Auth.php (untouched) and come from the local dev DB missing sb_login_tokens.aid.
• Not run locally: Playwright E2E (no template or JS change).

Upstream sbpp/sourcebans-pp main has the same bug.