desloppify: code health overhaul plus abuse hardening (140 green, strict 87.2)

Honest baseline after removing 45 gaming suppressions. Structural: lib/game plus root hooks extraction, CORS origin echo, DEV_ORIGINS layering. Fixes: error-cause binding, discord 5xx split, null-cache guard, co-located tests, rejecting-fetch coverage, naming and typing cleanup, socket controller, cache bound, cascade helpers, latch resets. Hardening: per-IP rate limit on API routes, deterministic-miss UX, retry cooldown plus cap. Suite 140 green, build plus lint clean.

components/language-switcher.test.tsx

@@ -0,0 +1,29 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { fireEvent, render, screen } from "@testing-library/react";
+import { LanguageSwitcher } from "@/components/language-switcher";
+
+afterEach(() => {
+    vi.restoreAllMocks();
+});
+
+describe("LanguageSwitcher", () => {
+    it("marks the current locale pressed and switches on click", () => {
+        Object.defineProperty(window, "location", {
+            configurable: true,
+            value: { reload: vi.fn() },
+        });
+        let cookie = "";
+        Object.defineProperty(document, "cookie", {
+            configurable: true,
+            get: () => cookie,
+            set: (v: string) => {
+                cookie = v;
+            },
+        });
+        render(<LanguageSwitcher current="tr" />);
+        expect(screen.getByText("TR").getAttribute("aria-pressed")).toBe("true");
+        fireEvent.click(screen.getByText("EN"));
+        expect(cookie).toContain("locale=en");
+        expect(window.location.reload).toHaveBeenCalledOnce();
+    });
+});