desloppify: code health overhaul plus abuse hardening (140 green, strict 87.2)

Honest baseline after removing 45 gaming suppressions. Structural: lib/game plus root hooks extraction, CORS origin echo, DEV_ORIGINS layering. Fixes: error-cause binding, discord 5xx split, null-cache guard, co-located tests, rejecting-fetch coverage, naming and typing cleanup, socket controller, cache bound, cascade helpers, latch resets. Hardening: per-IP rate limit on API routes, deterministic-miss UX, retry cooldown plus cap. Suite 140 green, build plus lint clean.

components/site-header.test.tsx

@@ -0,0 +1,14 @@
+import { describe, expect, it } from "vitest";
+import { render, screen } from "@testing-library/react";
+import { SiteHeader } from "@/components/site-header";
+import { getDictionary } from "@/lib/i18n/get-dictionary";
+
+describe("SiteHeader", () => {
+    it("renders brand, nav anchors, and language options", () => {
+        const dict = getDictionary("tr");
+        const { container } = render(<SiteHeader dict={dict.nav} locale="tr" />);
+        expect(container.querySelector('a[href="#top"]')).not.toBeNull();
+        expect(screen.getByText(dict.nav.discord)).toBeDefined();
+        expect(screen.getByRole("group", { name: "language" })).toBeDefined();
+    });
+});