desloppify: code health overhaul plus abuse hardening (140 green, strict 87.2)

Honest baseline after removing 45 gaming suppressions. Structural: lib/game plus root hooks extraction, CORS origin echo, DEV_ORIGINS layering. Fixes: error-cause binding, discord 5xx split, null-cache guard, co-located tests, rejecting-fetch coverage, naming and typing cleanup, socket controller, cache bound, cascade helpers, latch resets. Hardening: per-IP rate limit on API routes, deterministic-miss UX, retry cooldown plus cap. Suite 140 green, build plus lint clean.

hooks/use-lanyard.test.tsx

@@ -0,0 +1,19 @@
+import { describe, expect, it } from "vitest";
+import { renderHook } from "@testing-library/react";
+import { useLanyard } from "@/hooks/use-lanyard";
+import { lanyardFixture } from "@/test/fixtures";
+
+describe("useLanyard", () => {
+    it("returns the initial snapshot synchronously", () => {
+        const initial = lanyardFixture();
+        const { result, unmount } = renderHook(() => useLanyard(initial));
+        expect(result.current?.discord_user.username).toBe("testuser");
+        unmount();
+    });
+
+    it("starts empty without initial data", () => {
+        const { result, unmount } = renderHook(() => useLanyard(null));
+        expect(result.current).toBeNull();
+        unmount();
+    });
+});