desloppify: code health overhaul plus abuse hardening (140 green, strict 87.2)

Honest baseline after removing 45 gaming suppressions. Structural: lib/game plus root hooks extraction, CORS origin echo, DEV_ORIGINS layering. Fixes: error-cause binding, discord 5xx split, null-cache guard, co-located tests, rejecting-fetch coverage, naming and typing cleanup, socket controller, cache bound, cascade helpers, latch resets. Hardening: per-IP rate limit on API routes, deterministic-miss UX, retry cooldown plus cap. Suite 140 green, build plus lint clean.

lib/i18n/get-locale.test.ts

@@ -0,0 +1,25 @@
+import { describe, expect, it, vi } from "vitest";
+
+vi.mock("next/headers", () => ({
+    cookies: vi.fn(),
+}));
+
+import { cookies } from "next/headers";
+import { getLocale } from "@/lib/i18n/get-locale";
+
+describe("getLocale", () => {
+    it("returns the cookie locale when valid", async () => {
+        vi.mocked(cookies).mockResolvedValue({ get: () => ({ value: "de" }) } as never);
+        await expect(getLocale()).resolves.toBe("de");
+    });
+
+    it("falls back to default without a cookie", async () => {
+        vi.mocked(cookies).mockResolvedValue({ get: () => undefined } as never);
+        await expect(getLocale()).resolves.toBe("tr");
+    });
+
+    it("falls back on unknown values", async () => {
+        vi.mocked(cookies).mockResolvedValue({ get: () => ({ value: "fr" }) } as never);
+        await expect(getLocale()).resolves.toBe("tr");
+    });
+});