desloppify: code health overhaul plus abuse hardening (140 green, strict 87.2)

Honest baseline after removing 45 gaming suppressions. Structural: lib/game plus root hooks extraction, CORS origin echo, DEV_ORIGINS layering. Fixes: error-cause binding, discord 5xx split, null-cache guard, co-located tests, rejecting-fetch coverage, naming and typing cleanup, socket controller, cache bound, cascade helpers, latch resets. Hardening: per-IP rate limit on API routes, deterministic-miss UX, retry cooldown plus cap. Suite 140 green, build plus lint clean.

lib/game/lanyard.ts

@@ -0,0 +1,134 @@
+import { warnDev } from "@/lib/log";
+
+export const DISCORD_ID = "1014549805608992901";
+
+export const LANYARD_API = `https://api.lanyard.rest/v1/users/${DISCORD_ID}`;
+
+export const LANYARD_WS = "wss://api.lanyard.rest/socket";
+
+export type DiscordStatus = "online" | "idle" | "dnd" | "offline";
+
+export interface LanyardEmoji {
+    name: string;
+    id?: string;
+    animated?: boolean;
+}
+
+export interface LanyardActivityAssets {
+    large_image?: string;
+    large_text?: string;
+    small_image?: string;
+    small_text?: string;
+}
+
+export interface LanyardActivity {
+    id: string;
+    name: string;
+    type: number;
+    state?: string | null;
+    details?: string | null;
+    emoji?: LanyardEmoji | null;
+    timestamps?: { start?: number; end?: number } | null;
+    application_id?: string | null;
+    assets?: LanyardActivityAssets | null;
+}
+
+export type ActivityImageSize = "small" | "large";
+
+export function activityImageUrl(
+    activity: LanyardActivity,
+    size: ActivityImageSize = "large",
+): string | null {
+    const key = size === "small" ? activity.assets?.small_image : activity.assets?.large_image;
+    if (!key) {
+        return null;
+    }
+    if (key.startsWith("mp:")) {
+        return `https://media.discordapp.net/external/${key.slice(3)}`;
+    }
+    if (key.startsWith("spotify:")) {
+        return `https://i.scdn.co/image/${key.slice("spotify:".length)}`;
+    }
+    if (activity.application_id) {
+        return `https://cdn.discordapp.com/app-assets/${activity.application_id}/${key}.png`;
+    }
+    return null;
+}
+
+export interface LanyardSpotify {
+    track_id: string;
+    timestamps: {
+        start: number;
+        end: number;
+    };
+    song: string;
+    artist: string;
+    album: string;
+    album_art_url: string | null;
+}
+
+export function formatSpotifyList(value: string | null | undefined): string {
+    if (!value) {
+        return "";
+    }
+    return value
+        .replace(/;/g, ",")
+        .replace(/,[ \t]+,/g, ",")
+        .replace(/\s{2,}/g, " ")
+        .trim();
+}
+
+export function spotifyTrackUrl(trackId: string): string {
+    return `https://open.spotify.com/track/${trackId}`;
+}
+
+export interface LanyardData {
+    discord_user: {
+        id: string;
+        username: string;
+        global_name: string | null;
+        display_name: string | null;
+        discriminator: string;
+        avatar: string | null;
+        bot: boolean;
+    };
+    activities: LanyardActivity[];
+    discord_status: DiscordStatus;
+    active_on_discord_desktop: boolean;
+    active_on_discord_mobile: boolean;
+    active_on_discord_web: boolean;
+    listening_to_spotify: boolean;
+    spotify: LanyardSpotify | null;
+}
+
+interface LanyardResponse {
+    success: boolean;
+    data: LanyardData;
+}
+
+export async function getLanyard(): Promise<LanyardData | null> {
+    try {
+        const response = await fetch(LANYARD_API, { next: { revalidate: 10 } });
+        if (!response.ok) {
+            warnDev(`lanyard failed: ${response.status}`);
+            return null;
+        }
+        const json = (await response.json()) as LanyardResponse;
+        return json.success ? json.data : null;
+    } catch (error) {
+        warnDev(`lanyard request failed: ${error instanceof Error ? error.message : error}`);
+        return null;
+    }
+}
+
+export function discordAvatarUrl(userId: string, avatarHash: string | null, size = 128): string {
+    if (!avatarHash) {
+        return `https://cdn.discordapp.com/embed/avatars/0.png?size=${size}`;
+    }
+    const extension = avatarHash.startsWith("a_") ? "gif" : "png";
+    return `https://cdn.discordapp.com/avatars/${userId}/${avatarHash}.${extension}?size=${size}`;
+}
+
+export function discordProfileUrl(userId: string): string {
+    return `https://discord.com/users/${userId}`;
+}