desloppify: code health overhaul plus abuse hardening (140 green, strict 87.2)

Honest baseline after removing 45 gaming suppressions. Structural: lib/game plus root hooks extraction, CORS origin echo, DEV_ORIGINS layering. Fixes: error-cause binding, discord 5xx split, null-cache guard, co-located tests, rejecting-fetch coverage, naming and typing cleanup, socket controller, cache bound, cascade helpers, latch resets. Hardening: per-IP rate limit on API routes, deterministic-miss UX, retry cooldown plus cap. Suite 140 green, build plus lint clean.

components/language-switcher.tsx

@@ -1,6 +1,6 @@
 "use client";
 
-import { LOCALES, LOCALE_LABELS, LOCALE_COOKIE, isLocale, type Locale } from "@/lib/i18n/locales";
+import { LOCALES, LOCALE_LABELS, LOCALE_COOKIE, type Locale } from "@/lib/i18n/locales";
 
 function writeLocaleCookie(locale: Locale): void {
     document.cookie = `${LOCALE_COOKIE}=${locale}; path=/; max-age=31536000; SameSite=Lax`;
@@ -8,7 +8,7 @@ function writeLocaleCookie(locale: Locale): void {
 
 export function LanguageSwitcher({ current }: { current: Locale }) {
     function switchTo(locale: Locale) {
-        if (locale === current || !isLocale(locale)) {
+        if (locale === current) {
             return;
         }
         writeLocaleCookie(locale);