desloppify: code health overhaul plus abuse hardening (140 green, strict 87.2)

Honest baseline after removing 45 gaming suppressions. Structural: lib/game plus root hooks extraction, CORS origin echo, DEV_ORIGINS layering. Fixes: error-cause binding, discord 5xx split, null-cache guard, co-located tests, rejecting-fetch coverage, naming and typing cleanup, socket controller, cache bound, cascade helpers, latch resets. Hardening: per-IP rate limit on API routes, deterministic-miss UX, retry cooldown plus cap. Suite 140 green, build plus lint clean.

app/layout.test.tsx

@@ -0,0 +1,27 @@
+import { describe, expect, it, vi } from "vitest";
+import { render, screen } from "@testing-library/react";
+
+vi.mock("next/font/google", () => ({
+    Cascadia_Mono: () => ({ variable: "font-test" }),
+}));
+
+vi.mock("@/lib/i18n/get-locale", () => ({
+    getLocale: async () => "en" as const,
+}));
+
+import RootLayout, { generateMetadata } from "@/app/layout";
+
+describe("generateMetadata", () => {
+    it("builds site metadata for the locale", async () => {
+        const meta = await generateMetadata();
+        expect(meta.description).toBeTruthy();
+    });
+});
+
+describe("RootLayout", () => {
+    it("renders children inside the locale shell", async () => {
+        render(await RootLayout({ children: <p>child</p>, params: Promise.resolve({}) }));
+        expect(screen.getByText("child")).toBeDefined();
+        expect(document.documentElement.lang).toBe("en");
+    });
+});