desloppify: code health overhaul plus abuse hardening (140 green, strict 87.2)

Honest baseline after removing 45 gaming suppressions. Structural: lib/game plus root hooks extraction, CORS origin echo, DEV_ORIGINS layering. Fixes: error-cause binding, discord 5xx split, null-cache guard, co-located tests, rejecting-fetch coverage, naming and typing cleanup, socket controller, cache bound, cascade helpers, latch resets. Hardening: per-IP rate limit on API routes, deterministic-miss UX, retry cooldown plus cap. Suite 140 green, build plus lint clean.

lib/game/detectables.ts

@@ -0,0 +1,37 @@
+import { warnDev } from "@/lib/log";
+import type { DetectableEntry } from "@/lib/game/game-profile-types";
+
+const DETECTABLES_URL = "https://cdn.discordapp.com/detectables/games-v1.json";
+const DETECTABLES_TTL_MS = 86_400_000;
+
+let detectablesCache: { data: DetectableEntry[]; expires: number } | null = null;
+
+export function _resetDetectablesCache(): void {
+    detectablesCache = null;
+}
+
+export async function getDetectables(): Promise<DetectableEntry[]> {
+    if (detectablesCache && Date.now() < detectablesCache.expires) {
+        return detectablesCache.data;
+    }
+    try {
+        const response = await fetch(DETECTABLES_URL);
+        if (!response.ok) {
+            warnDev(`detectables failed: ${response.status}`);
+            return detectablesCache?.data ?? [];
+        }
+        const data = (await response.json()) as DetectableEntry[];
+        detectablesCache = { data, expires: Date.now() + DETECTABLES_TTL_MS };
+        return data;
+    } catch (error) {
+        warnDev(`detectables request failed: ${error instanceof Error ? error.message : error}`);
+        return detectablesCache?.data ?? [];
+    }
+}
+
+export function steamIdFromEntry(entry: DetectableEntry | undefined): string | null {
+    const sku = entry?.third_party_skus?.find(
+        (s) => s.distributor === "steam" && /^\d+$/.test(s.id),
+    );
+    return sku?.id ?? null;
+}