desloppify: code health overhaul plus abuse hardening (140 green, strict 87.2)

Honest baseline after removing 45 gaming suppressions. Structural: lib/game plus root hooks extraction, CORS origin echo, DEV_ORIGINS layering. Fixes: error-cause binding, discord 5xx split, null-cache guard, co-located tests, rejecting-fetch coverage, naming and typing cleanup, socket controller, cache bound, cascade helpers, latch resets. Hardening: per-IP rate limit on API routes, deterministic-miss UX, retry cooldown plus cap. Suite 140 green, build plus lint clean.

lib/game/itad.ts

@@ -0,0 +1,48 @@
+import { normalizeGameTitle } from "@/lib/game/game-format";
+import { warnDev } from "@/lib/log";
+
+let itadKeyWarned = false;
+
+export function _resetItadWarning(): void {
+    itadKeyWarned = false;
+}
+
+export async function itadFetch<T>(path: string, init?: RequestInit): Promise<T | null> {
+    const key = process.env.ITAD_API_KEY;
+    if (!key) {
+        if (!itadKeyWarned) {
+            itadKeyWarned = true;
+            warnDev("itad not configured");
+        }
+        return null;
+    }
+    try {
+        const separator = path.includes("?") ? "&" : "?";
+        const response = await fetch(
+            `https://api.isthereanydeal.com${path}${separator}key=${key}`,
+            {
+                ...init,
+                next: { revalidate: 3600 },
+            },
+        );
+        if (!response.ok) {
+            warnDev(`itad failed: ${response.status}`);
+            return null;
+        }
+        return (await response.json()) as T;
+    } catch (error) {
+        warnDev(`itad request failed: ${error instanceof Error ? error.message : error}`);
+        return null;
+    }
+}
+
+export async function getItadId(title: string): Promise<string | null> {
+    const results = await itadFetch<Array<{ id?: string; title?: string }>>(
+        `/games/search/v1?title=${encodeURIComponent(title)}&results=5`,
+    );
+    if (!results || results.length === 0) {
+        return null;
+    }
+    const wanted = normalizeGameTitle(title);
+    return results.find((r) => r.title && normalizeGameTitle(r.title) === wanted)?.id ?? null;
+}