chore: repo-wide bloat sweep, remove dead code and fold duplicate helpers (#2150)

* chore: repo-wide bloat sweep, remove dead code and fold duplicate helpers

Remove 33 dead files, ~270 unreferenced exports/types, 13 dead i18n
namespaces and 4 unused dependencies; fold byte-identical helper copies
into one canonical home each (lib/utils chunk/sleep/utcDateStamp,
lib/dates/iso, lib/invariants/uuid, lib/xml/escape, lib/reports/sru/format,
lib/pdf/number-text, lib/browser/panel-request, lib/api/v1/body +
v1ValidationError rolled out to ~55 v1 routes, booking-template schemas).

No behaviour change: v1 bodies and status codes, MCP tool schemas, DB
writes and money math are untouched. Naive ore rounding was deliberately
not swapped for roundOre; see DECISIONS.md 2026-09-02 for the full list
of things left alone on purpose.

tsc, lint, 19588 unit tests and check:guards green; antipattern baseline
ratcheted (naive-ore-round 622 -> 620, hand-rolled-invariant 115 -> 113).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* test(transactions): import RawTransaction from @/types after the ingest re-export removal

CI's type ratchet (check:types, full tsconfig) caught the one test file
that still imported the type through lib/transactions/ingest.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

---------

Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

lib/api/__tests__/token-rate-limit.test.ts

@@ -0,0 +1,41 @@
+import { describe, it, expect, vi, afterEach } from 'vitest'
+import { createTokenRateLimiter } from '../token-rate-limit'
+
+describe('createTokenRateLimiter', () => {
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
+  it('allows up to max requests per window, then refuses', () => {
+    const limiter = createTokenRateLimiter({ max: 3, windowMs: 60_000 })
+    expect(limiter.allow('a')).toBe(true)
+    expect(limiter.allow('a')).toBe(true)
+    expect(limiter.allow('a')).toBe(true)
+    expect(limiter.allow('a')).toBe(false)
+  })
+
+  it('keys the budget per token', () => {
+    const limiter = createTokenRateLimiter({ max: 1, windowMs: 60_000 })
+    expect(limiter.allow('a')).toBe(true)
+    expect(limiter.allow('b')).toBe(true)
+    expect(limiter.allow('a')).toBe(false)
+  })
+
+  it('resets the budget once the window has passed', () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(new Date('2026-01-01T00:00:00Z'))
+    const limiter = createTokenRateLimiter({ max: 1, windowMs: 60_000 })
+    expect(limiter.allow('a')).toBe(true)
+    expect(limiter.allow('a')).toBe(false)
+    vi.setSystemTime(new Date('2026-01-01T00:01:00.001Z'))
+    expect(limiter.allow('a')).toBe(true)
+  })
+
+  it('keeps separate limiters isolated', () => {
+    const one = createTokenRateLimiter({ max: 1, windowMs: 60_000 })
+    const two = createTokenRateLimiter({ max: 1, windowMs: 60_000 })
+    expect(one.allow('a')).toBe(true)
+    expect(two.allow('a')).toBe(true)
+    expect(one.allow('a')).toBe(false)
+  })
+})