desloppify: code health overhaul plus abuse hardening (140 green, strict 87.2)

Honest baseline after removing 45 gaming suppressions. Structural: lib/game plus root hooks extraction, CORS origin echo, DEV_ORIGINS layering. Fixes: error-cause binding, discord 5xx split, null-cache guard, co-located tests, rejecting-fetch coverage, naming and typing cleanup, socket controller, cache bound, cascade helpers, latch resets. Hardening: per-IP rate limit on API routes, deterministic-miss UX, retry cooldown plus cap. Suite 140 green, build plus lint clean.

lib/gitea.ts

@@ -1,3 +1,5 @@
+import { warnDev } from "@/lib/log";
+
 const GITEA_API = "https://git.fristy.net/api/v1";
 const GITEA_USER = "fristy";
 
@@ -36,7 +38,7 @@ export async function getRepos(): Promise<GiteaRepo[]> {
             { next: { revalidate: 3600 } },
         );
         if (!response.ok) {
-            console.error(`cannot fetch gitea repos: ${response.status}`);
+            warnDev(`cannot fetch gitea repos: ${response.status}`);
             return [];
         }
         const data = (await response.json()) as GiteaApiRepo[];
@@ -55,8 +57,8 @@ export async function getRepos(): Promise<GiteaRepo[]> {
                 updatedAt: repo.updated_at,
             }))
             .sort((a, b) => +new Date(b.updatedAt) - +new Date(a.updatedAt));
-    } catch (error) {
-        console.error("cannot fetch gitea repos:", error);
+    } catch {
+        warnDev("cannot fetch gitea repos");
         return [];
     }
 }