desloppify: code health overhaul plus abuse hardening (140 green, strict 87.2)

Honest baseline after removing 45 gaming suppressions. Structural: lib/game plus root hooks extraction, CORS origin echo, DEV_ORIGINS layering. Fixes: error-cause binding, discord 5xx split, null-cache guard, co-located tests, rejecting-fetch coverage, naming and typing cleanup, socket controller, cache bound, cascade helpers, latch resets. Hardening: per-IP rate limit on API routes, deterministic-miss UX, retry cooldown plus cap. Suite 140 green, build plus lint clean.

lib/i18n/locales.test.ts

@@ -0,0 +1,36 @@
+import { describe, expect, it } from "vitest";
+import { isLocale, matchLocale } from "@/lib/i18n/locales";
+
+describe("isLocale", () => {
+    it("accepts supported locales", () => {
+        expect(isLocale("tr")).toBe(true);
+        expect(isLocale("en")).toBe(true);
+        expect(isLocale("de")).toBe(true);
+    });
+
+    it("rejects anything else", () => {
+        expect(isLocale("fr")).toBe(false);
+        expect(isLocale("")).toBe(false);
+    });
+});
+
+describe("matchLocale", () => {
+    it("defaults without a header", () => {
+        expect(matchLocale(null)).toBe("tr");
+        expect(matchLocale("")).toBe("tr");
+    });
+
+    it("matches primary ranges", () => {
+        expect(matchLocale("en-US,en;q=0.9")).toBe("en");
+        expect(matchLocale("de-DE,de;q=0.9,en;q=0.8")).toBe("de");
+    });
+
+    it("respects q-values", () => {
+        expect(matchLocale("en;q=0.5,tr;q=0.9")).toBe("tr");
+    });
+
+    it("falls back on unknown or wildcard ranges", () => {
+        expect(matchLocale("fr-FR,fr;q=0.9")).toBe("tr");
+        expect(matchLocale("*")).toBe("tr");
+    });
+});