desloppify: code health overhaul plus abuse hardening (140 green, strict 87.2)

Honest baseline after removing 45 gaming suppressions. Structural: lib/game plus root hooks extraction, CORS origin echo, DEV_ORIGINS layering. Fixes: error-cause binding, discord 5xx split, null-cache guard, co-located tests, rejecting-fetch coverage, naming and typing cleanup, socket controller, cache bound, cascade helpers, latch resets. Hardening: per-IP rate limit on API routes, deterministic-miss UX, retry cooldown plus cap. Suite 140 green, build plus lint clean.

package.json

@@ -7,6 +7,8 @@
         "build": "next build",
         "start": "next start",
         "lint": "eslint",
+        "test": "vitest run",
+        "test:watch": "vitest",
         "format": "prettier --write .",
         "format:check": "prettier --check ."
     },
@@ -17,15 +19,20 @@
     },
     "devDependencies": {
         "@tailwindcss/postcss": "^4.3.3",
+        "@testing-library/react": "^16.3.3",
         "@types/node": "^26.5.0",
         "@types/react": "^19.2.18",
         "@types/react-dom": "^19.2.7",
+        "@vitejs/plugin-react": "^6.1.1",
         "eslint": "^9.39.5",
         "eslint-config-next": "16.3.4",
         "eslint-config-prettier": "^10.1.8",
+        "jsdom": "^30.0.1",
         "prettier": "^3.9.6",
         "tailwindcss": "^4.3.3",
-        "typescript": "^6.0.3"
+        "typescript": "^6.0.3",
+        "vite-tsconfig-paths": "^6.1.1",
+        "vitest": "^5.0.0"
     },
     "packageManager": "pnpm@11.2.2"
 }