desloppify: code health overhaul plus abuse hardening (140 green, strict 87.2)

Honest baseline after removing 45 gaming suppressions. Structural: lib/game plus root hooks extraction, CORS origin echo, DEV_ORIGINS layering. Fixes: error-cause binding, discord 5xx split, null-cache guard, co-located tests, rejecting-fetch coverage, naming and typing cleanup, socket controller, cache bound, cascade helpers, latch resets. Hardening: per-IP rate limit on API routes, deterministic-miss UX, retry cooldown plus cap. Suite 140 green, build plus lint clean.

README.md

@@ -1,5 +1,7 @@
 # fristy.net
 
+![Code Health](scorecard.png)
+
 My personal corner of the internet — projects, live Discord status, and ways to reach me.
 
 **Live:** https://fristy.net
@@ -29,6 +31,7 @@ pnpm dev          # http://localhost:3000
 | `pnpm dev`          | Start the dev server            |
 | `pnpm build`        | Production build                |
 | `pnpm start`        | Serve the production build      |
+| `pnpm test`         | Run the Vitest suite            |
 | `pnpm lint`         | Run ESLint                      |
 | `pnpm format`       | Format everything with Prettier |
 | `pnpm format:check` | Fail if anything is unformatted |