chore: remediate pygienium audit findings

Dead code: 77 verified-unused exports, files (BackArrow, MenuBars,
cookies.ts, db/create.ts, schemas/comment.ts, security-headers.ts) and
12 unused dependencies removed
Comments: ~370 RESTATE comments stripped across 53 files; 2 verbose
blocks tightened; dead commented-out config removed
Complexity: bulkUpsert extracted into 11 per-entity helpers (CCN 156->~10);
login formHandler split into 3 submitters (CCN 63->~5); account page render
split into 8 section components (CCN 40); updatePost SQL builder rebuilt;
assert*Owned consolidated behind generic assertOwnedBy
Defensive guards: 4 redundant rethrow/nullish guards removed

src/server/email-templates/index.ts

@@ -5,7 +5,6 @@ import loginLinkTemplate from "./login-link.html?raw";
 import passwordResetTemplate from "./password-reset.html?raw";
 import emailVerificationTemplate from "./email-verification.html?raw";
 import providerLinkedTemplate from "./provider-linked.html?raw";
-import newDeviceLoginTemplate from "./new-device-login.html?raw";
 import passwordSetTemplate from "./password-set.html?raw";
 
 /**
@@ -119,29 +118,6 @@ export function generateProviderLinkedEmail(
   });
 }
 
-export interface NewDeviceLoginEmailParams {
-  deviceInfo: string;
-  loginTime: string;
-  ipAddress: string;
-  loginMethod: string;
-  accountUrl: string;
-}
-
-/**
- * Generate new device login notification email HTML
- */
-export function generateNewDeviceLoginEmail(
-  params: NewDeviceLoginEmailParams
-): string {
-  return processTemplate(newDeviceLoginTemplate, {
-    DEVICE_INFO: params.deviceInfo,
-    LOGIN_TIME: params.loginTime,
-    IP_ADDRESS: params.ipAddress,
-    LOGIN_METHOD: params.loginMethod,
-    ACCOUNT_URL: params.accountUrl
-  });
-}
-
 export interface PasswordSetEmailParams {
   providerName: string;
   setTime: string;