desloppify: code health overhaul plus abuse hardening (140 green, strict 87.2)

Honest baseline after removing 45 gaming suppressions. Structural: lib/game plus root hooks extraction, CORS origin echo, DEV_ORIGINS layering. Fixes: error-cause binding, discord 5xx split, null-cache guard, co-located tests, rejecting-fetch coverage, naming and typing cleanup, socket controller, cache bound, cascade helpers, latch resets. Hardening: per-IP rate limit on API routes, deterministic-miss UX, retry cooldown plus cap. Suite 140 green, build plus lint clean.

lib/log.test.ts

@@ -0,0 +1,23 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { warnDev } from "@/lib/log";
+
+afterEach(() => {
+    vi.unstubAllGlobals();
+    vi.restoreAllMocks();
+});
+
+describe("warnDev", () => {
+    it("warns outside production", () => {
+        vi.stubGlobal("process", { ...process, env: { ...process.env, NODE_ENV: "test" } });
+        const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+        warnDev("hello");
+        expect(warn).toHaveBeenCalledWith("hello");
+    });
+
+    it("stays silent in production", () => {
+        vi.stubGlobal("process", { ...process, env: { ...process.env, NODE_ENV: "production" } });
+        const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+        warnDev("hello");
+        expect(warn).not.toHaveBeenCalled();
+    });
+});