chore: remediate pygienium audit findings

Dead code: 77 verified-unused exports, files (BackArrow, MenuBars,
cookies.ts, db/create.ts, schemas/comment.ts, security-headers.ts) and
12 unused dependencies removed
Comments: ~370 RESTATE comments stripped across 53 files; 2 verbose
blocks tightened; dead commented-out config removed
Complexity: bulkUpsert extracted into 11 per-entity helpers (CCN 156->~10);
login formHandler split into 3 submitters (CCN 63->~5); account page render
split into 8 section components (CCN 40); updatePost SQL builder rebuilt;
assert*Owned consolidated behind generic assertOwnedBy
Defensive guards: 4 redundant rethrow/nullish guards removed

src/routes/api/Gaze/appcast.xml.ts

@@ -39,7 +39,6 @@ export async function GET(_event: APIEvent) {
       });
     }
 
-    // Stream the XML content from S3
     const body = await response.Body.transformToString();
 
     return new Response(body, {

src/routes/api/InputHalo/appcast.xml.ts

@@ -39,7 +39,6 @@ export async function GET(_event: APIEvent) {
       });
     }
 
-    // Stream the XML content from S3
     const body = await response.Body.transformToString();
 
     return new Response(body, {

src/routes/api/auth/email-login-callback.ts

@@ -20,7 +20,6 @@ export async function GET(event: APIEvent) {
     "emailLogin",
     (caller, params) => caller.auth.emailLogin(params),
     (error) => {
-      // Check for token expiration
       const message = error instanceof Error ? error.message : "";
       const isTokenError =
         message.includes("expired") || message.includes("invalid");

src/routes/api/auth/email-verification-callback.ts

@@ -62,17 +62,14 @@ export async function GET(event: APIEvent) {
   }
 
   try {
-    // Create tRPC caller to invoke the emailVerification procedure
     const caller = await createServerCaller(event);
 
-    // Call the email verification handler
     const result = await caller.auth.emailVerification({
       email,
       token
     });
 
     if (result.success) {
-      // Show success page
       return new Response(
         `
         <!DOCTYPE html>
@@ -136,7 +133,6 @@ export async function GET(event: APIEvent) {
   } catch (error) {
     console.error("Email verification callback error:", error);
 
-    // Check if it's a token expiration error
     const errorMessage =
       error instanceof Error ? error.message : "server_error";
     const isTokenError =

src/routes/api/downloads/[filename].ts

@@ -24,7 +24,6 @@ export async function GET(event: APIEvent) {
     });
   }
 
-  // Validate filename format (only allow Gaze or InputHalo files)
   const validPrefixes = ["Gaze", "InputHalo"];
   const isValidPrefix = validPrefixes.some((prefix) => filename.startsWith(prefix));
   if (
@@ -70,12 +69,10 @@ export async function GET(event: APIEvent) {
       });
     }
 
-    // Get content type based on file extension
     const contentType = filename.endsWith(".dmg")
       ? "application/x-apple-diskimage"
       : "application/octet-stream";
 
-    // Stream the file content from S3
     const body = await response.Body.transformToByteArray();
 
     console.log(`✓ Serving ${filename} (${body.length} bytes)`);
@@ -93,7 +90,6 @@ export async function GET(event: APIEvent) {
   } catch (error) {
     console.error(`Failed to fetch ${filename} from S3:`, error);
 
-    // Check if it's a not found error
     if (error instanceof Error && error.name === "NoSuchKey") {
       return new Response("File not found in storage", {
         status: 404,

src/routes/api/lineage/_lib.ts

@@ -58,8 +58,3 @@ export function bearerToken(event: APIEvent): string | null {
   const m = auth.match(/^Bearer\s+(.+)$/i);
   return m?.[1]?.trim() ?? null;
 }
-
-/** Parse the JSON request body. */
-export async function jsonBody<T = any>(event: APIEvent): Promise<T> {
-  return await event.request.json();
-}