desloppify: code health overhaul plus abuse hardening (140 green, strict 87.2)

Honest baseline after removing 45 gaming suppressions. Structural: lib/game plus root hooks extraction, CORS origin echo, DEV_ORIGINS layering. Fixes: error-cause binding, discord 5xx split, null-cache guard, co-located tests, rejecting-fetch coverage, naming and typing cleanup, socket controller, cache bound, cascade helpers, latch resets. Hardening: per-IP rate limit on API routes, deterministic-miss UX, retry cooldown plus cap. Suite 140 green, build plus lint clean.

lib/gitea.test.ts

@@ -0,0 +1,59 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { getRepos } from "@/lib/gitea";
+
+afterEach(() => {
+    vi.unstubAllGlobals();
+    vi.restoreAllMocks();
+});
+
+function apiRepo(overrides: Record<string, unknown>) {
+    return {
+        id: 0,
+        name: "repo",
+        full_name: "fristy/repo",
+        description: null,
+        language: null,
+        html_url: "https://git.fristy.net/fristy/repo",
+        website: "",
+        stars_count: 0,
+        forks_count: 0,
+        updated_at: "2024-01-01T00:00:00Z",
+        ...overrides,
+    };
+}
+
+describe("getRepos", () => {
+    it("maps, filters, and sorts repos", async () => {
+        const payload = [
+            apiRepo({ id: 2, name: "old", full_name: "fristy/old", language: "TypeScript" }),
+            apiRepo({ id: 1, name: ".profile", updated_at: "2025-01-01T00:00:00Z" }),
+            apiRepo({
+                id: 3,
+                name: "new",
+                full_name: "fristy/new",
+                description: "fresh",
+                language: "Go",
+                website: "https://example.com",
+                stars_count: 5,
+                forks_count: 2,
+                updated_at: "2026-01-01T00:00:00Z",
+            }),
+        ];
+        vi.stubGlobal(
+            "fetch",
+            vi.fn(async () => ({ ok: true, json: async () => payload })),
+        );
+        const repos = await getRepos();
+        expect(repos.map((r) => r.name)).toEqual(["new", "old"]);
+        expect(repos[0]?.website).toBe("https://example.com");
+        expect(repos[1]?.website).toBeNull();
+    });
+
+    it("returns empty on HTTP error", async () => {
+        vi.stubGlobal(
+            "fetch",
+            vi.fn(async () => ({ ok: false, status: 500 })),
+        );
+        await expect(getRepos()).resolves.toEqual([]);
+    });
+});