desloppify: code health overhaul plus abuse hardening (140 green, strict 87.2)

Honest baseline after removing 45 gaming suppressions. Structural: lib/game plus root hooks extraction, CORS origin echo, DEV_ORIGINS layering. Fixes: error-cause binding, discord 5xx split, null-cache guard, co-located tests, rejecting-fetch coverage, naming and typing cleanup, socket controller, cache bound, cascade helpers, latch resets. Hardening: per-IP rate limit on API routes, deterministic-miss UX, retry cooldown plus cap. Suite 140 green, build plus lint clean.

lib/site.ts

@@ -7,3 +7,7 @@ export const DISCORD_SERVER_URL = "https://discord.gg/fristy";
 export const SPOTIFY_URL = "https://open.spotify.com/user/gayiw5j9i0rtvyra6gfzhpfwf";
 export const STEAM_URL = "https://steamcommunity.com/id/fristylikeaillusion";
 export const APACHE_LICENSE_URL = "https://www.apache.org/licenses/LICENSE-2.0";
+export const DEV_ORIGINS: ReadonlySet<string> = new Set([
+    "http://localhost:3000",
+    "http://127.0.0.1:3000",
+]);