Reduce measured legacy code-health debt

[sarthakagrawal927]

Track debt measured during Fleet code-health adoption: incomplete whole-source coverage, complexity hotspots, exact duplication, justified suppressions, and any dependency advisories that cannot be removed without separately reviewed framework or production dependency changes. Checked-in ratchets must reject regressions, and each improvement should lower the baseline intentionally.

[sarthakagrawal927]

Measured baseline from the isolated code-health adoption worktree (2026-08-12):

• App/Worker coverage over all src/lib/**/*.{ts,tsx}: 37.07% lines, 28.21% branches, 35.28% functions, 34.88% statements across 93 passing tests. The extension adds 20 passing tests outside the root V8 denominator.
• Lint: 0 errors and 39 established Biome warnings across 190 checked files.
• Complexity: 1,410 functions / 14,672 NLOC; 37 functions exceed CCN 15, length 100, or 7 params; max CCN 68, max length 606, max params 11.
• Duplication: 37 exact clone groups, 493/23,665 lines (2.0832%) across 148 production/config files.
• Suppressions: 5 source/test markers.
• Dependencies: 0 critical, 2 high Astro 5 advisories (GHSA-8hv8-536x-4wqp, GHSA-2pvr-wf23-7pc7); fixes require a major Astro migration. Audit also reports 5 moderate and 3 low advisories.
• Clean boundaries: zero unused files/exports/types/packages/unlisted/unresolved findings and zero JS/TS import cycles after removing the retired 495-line Firebase migration, one unused extension settings panel, unused test dependencies, redundant UI exports, and unused public helper boundaries.

The local pnpm quality gate treats every count as a ceiling and verifies app/Worker/landing/extension tests, types, docs, and production builds. Any regression fails; improvements should deliberately lower the baseline. Code-cleanup receipt: run_260cc25f8211e3a7f19e9cec53d1a644.