desloppify: code health overhaul plus abuse hardening (140 green, strict 87.2)

Honest baseline after removing 45 gaming suppressions. Structural: lib/game plus root hooks extraction, CORS origin echo, DEV_ORIGINS layering. Fixes: error-cause binding, discord 5xx split, null-cache guard, co-located tests, rejecting-fetch coverage, naming and typing cleanup, socket controller, cache bound, cascade helpers, latch resets. Hardening: per-IP rate limit on API routes, deterministic-miss UX, retry cooldown plus cap. Suite 140 green, build plus lint clean.

lib/client-fetch.ts

@@ -0,0 +1,15 @@
+import { warnDev } from "@/lib/log";
+
+export async function fetchJson<T>(url: string, init?: RequestInit): Promise<T | null> {
+    try {
+        const response = await fetch(url, init);
+        if (!response.ok) {
+            warnDev(`client fetch failed: ${url.split("?")[0]} -> ${response.status}`);
+            return null;
+        }
+        return (await response.json()) as T;
+    } catch {
+        warnDev(`client fetch failed: ${url.split("?")[0]}`);
+        return null;
+    }
+}