desloppify: code health overhaul plus abuse hardening (140 green, strict 87.2)

Honest baseline after removing 45 gaming suppressions. Structural: lib/game plus root hooks extraction, CORS origin echo, DEV_ORIGINS layering. Fixes: error-cause binding, discord 5xx split, null-cache guard, co-located tests, rejecting-fetch coverage, naming and typing cleanup, socket controller, cache bound, cascade helpers, latch resets. Hardening: per-IP rate limit on API routes, deterministic-miss UX, retry cooldown plus cap. Suite 140 green, build plus lint clean.

lib/game/lanyard.test.ts

@@ -0,0 +1,109 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import {
+    activityImageUrl,
+    discordAvatarUrl,
+    formatSpotifyList,
+    getLanyard,
+    spotifyTrackUrl,
+    type LanyardActivity,
+} from "@/lib/game/lanyard";
+
+afterEach(() => {
+    vi.unstubAllGlobals();
+    vi.restoreAllMocks();
+});
+
+function activity(overrides: Partial<LanyardActivity> = {}): LanyardActivity {
+    return { id: "1", name: "Game", type: 0, ...overrides };
+}
+
+describe("activityImageUrl", () => {
+    it("resolves external media keys", () => {
+        expect(activityImageUrl(activity({ assets: { large_image: "mp:abc" } }), "large")).toBe(
+            "https://media.discordapp.net/external/abc",
+        );
+    });
+
+    it("resolves Spotify keys", () => {
+        expect(activityImageUrl(activity({ assets: { large_image: "spotify:img" } }), "large")).toBe(
+            "https://i.scdn.co/image/img",
+        );
+    });
+
+    it("resolves app assets with application id", () => {
+        expect(
+            activityImageUrl(
+                activity({ application_id: "9", assets: { large_image: "art" } }),
+                "large",
+            ),
+        ).toBe("https://cdn.discordapp.com/app-assets/9/art.png");
+    });
+
+    it("returns null without a key", () => {
+        expect(activityImageUrl(activity(), "large")).toBeNull();
+    });
+
+    it("picks small vs large art", () => {
+        const withBoth = activity({
+            assets: { large_image: "mp:big", small_image: "mp:small" },
+        });
+        expect(activityImageUrl(withBoth, "small")).toContain("small");
+        expect(activityImageUrl(withBoth, "large")).toContain("big");
+    });
+});
+
+describe("formatSpotifyList", () => {
+    it("normalizes separators", () => {
+        expect(formatSpotifyList("a;b,  ,c")).toBe("a,b,c");
+        expect(formatSpotifyList("a  b")).toBe("a b");
+    });
+
+    it("returns empty for nullish input", () => {
+        expect(formatSpotifyList(null)).toBe("");
+        expect(formatSpotifyList(undefined)).toBe("");
+    });
+});
+
+describe("spotifyTrackUrl", () => {
+    it("builds the track URL", () => {
+        expect(spotifyTrackUrl("xyz")).toBe("https://open.spotify.com/track/xyz");
+    });
+});
+
+describe("discordAvatarUrl", () => {
+    it("falls back to the default avatar", () => {
+        expect(discordAvatarUrl("1", null)).toContain("embed/avatars/0.png");
+    });
+
+    it("picks gif for animated hashes", () => {
+        expect(discordAvatarUrl("1", "a_hash")).toContain(".gif");
+        expect(discordAvatarUrl("1", "hash")).toContain(".png");
+    });
+});
+
+describe("getLanyard", () => {
+    it("returns data on success and null otherwise", async () => {
+        vi.stubGlobal(
+            "fetch",
+            vi.fn(async () => ({ ok: true, json: async () => ({ success: true, data: {} }) })),
+        );
+        await expect(getLanyard()).resolves.toEqual({});
+        vi.stubGlobal(
+            "fetch",
+            vi.fn(async () => ({ ok: true, json: async () => ({ success: false }) })),
+        );
+        await expect(getLanyard()).resolves.toBeNull();
+        vi.stubGlobal(
+            "fetch",
+            vi.fn(async () => ({ ok: false, status: 500 }) as Response),
+        );
+        await expect(getLanyard()).resolves.toBeNull();
+        vi.stubGlobal(
+            "fetch",
+            vi.fn(async () => {
+                throw new Error("down");
+            }),
+        );
+        await expect(getLanyard()).resolves.toBeNull();
+    });
+});