In-file cleanup: settings, adapters, auth, db scripts (backend campaign 7)

[theobong]

What changed

A behavior-neutral cleanup inside the files of three areas: settings loading, service wiring and the vendor adapters; sign-in, sessions, abuse checks and guest reports; the database scripts, seeds and backfills. Large functions are split into named helpers, repeated code is shared, magic numbers and strings are named, and dead code and needless exports are removed. Nothing a user sees should change.

Before you start

• Where: staging (civfix.dev, the staging mobile build) after this merges to main
• Sign in as: your own accounts with an emailed code (the reviewer code cannot be typed on web and is not enabled on staging); a throwaway account for the delete step; a second browser profile for the chat step
• Stacked on Comment, em dash and emoji sweep (backend campaign 6) #95 (comment sweep). Read only this PR's diff against Comment, em dash and emoji sweep (backend campaign 6) #95's branch.
• Size: 8913 counted lines. Campaign PR; the author approved PRs over the 400-line cap for this cleanup.
• Reading order: one commit per area (settings and adapters; sign-in and guest reports; database scripts).

Verify

Nothing new to verify: every step below is a regression check.

Regression

Signing in with an emailed code, then out — [Web] [Mobile]

1. Open civfix.dev and click "Sign in", then "Continue with email"
2. Type your email and click "Send me a code" — Expect: "Check your inbox" and a 6-digit code email
3. Type a wrong code and submit — Expect: "That code is invalid or expired. Request a new one."
4. Type the right code and click "Verify code" — Expect: the dialog closes and you are signed in
5. Open your profile, click the "Settings" gear, then "Sign out" — Expect: you are signed out and a reload stays signed out
6. On mobile, sign in the same way ("Continue with email", "Send me a code", then "Verify") — Expect: signed in

Signing in with Google or Apple — [Web]

1. Click "Sign in", then "Continue with Google" — Expect: Google's consent page, then back on civfix.dev signed in
2. Sign out, click "Sign in", then "Continue with Apple" — Expect: back on civfix.dev signed in

Editing your profile and handle — [Web] [Mobile]

1. Open "Settings", then "Account", click "Display name", change it and click "Save name" — Expect: the new name shows on your profile
2. Click "Change handle" and type a handle someone already uses — Expect: "Checking availability..." then "That handle is taken."
3. Type an unused handle — Expect: "Available"; then click "Cancel" (saving starts a 30-day lock)

Deleting an account — [Web]

1. With the throwaway account open "Settings", then "Account", and click "Delete account"
2. Click "Email me a code", enter the emailed code and click "Permanently delete" — Expect: you are signed out and the account's posts show as "Deleted User"

Filing a guest report and claiming it — [Web]

1. Signed out, click "Report", then "Choose from library" and pick a photo; place the pin, pick a category, type a title, and click "Drop pin" — Expect: "Pin dropped. We're on it."
2. Click "View my report" — Expect: the report opens
3. In the same browser open civfix.dev/claim, click "Sign in to claim" and sign in — Expect: "Report linked"

Real-time chat — [Web]

1. Browser 1 (account A): open B's profile, click "Message"
2. Browser 2 (account B): open "Messages" and the conversation with A
3. Browser 1: type "hello" and click "Send message" — Expect: browser 2 shows it within a second or two without a reload, and shows the typing indicator while A types

Findings addressed

Campaign PRs 7 to 10: the LOCAL DUP, READ and DEAD ledger findings for chunks B01 to B03, plus local magic values, large-function splits and un-exports.

• B01: BE-DEAD-001, 005, 006, 007, 008, 009; BE-DUP-006; BE-READ-001, 002 (structure only, see below), 003, 004, 005, 006.
• B02: BE-DEAD-011, 012, 014, 017; BE-DUP-017, 018; BE-READ-009, 010, 011, 012, 013, 014, 016, 017.
• B03: BE-DEAD-021; BE-DUP-020; BE-READ-018, 019, 021.

Largest splits: settings loading (loadEnv, 355 lines) into section loaders with the same messages in the same order and the same fake-seam consequences; the container (buildContainer, 375 lines) into lazy, memoized builders that stay socket-free; the auth routes into five registrars; account erasure into named steps in the same transaction and order; the guest report transaction into five steps; the demo seed into generators plus a data module, with identical output per seed.

Decisions for the reviewer

• Behavior-neutral, with three reviewed exceptions:
  • Chat pub/sub now drops payloads that are not a frame envelope, with one warning that logs only the channel. Every version since June publishes envelopes, including the current production release, so the dropped branches cannot be reached.
  • The guest report response schema takes its status list from the shared contract. The values are identical today.
  • The sign-in nonce store and the websocket ticket store are built once at route registration instead of per request, and the session route reads the guest SMS flag once at registration. Both stores wrap the cache client that already exists at that point, so nothing opens earlier.
• The logger re-wiring proposed by BE-READ-002 is not in this PR. It attached the server logger at startup and moved the notification service from boot to first use: a real change in logging and construction timing. The container split stays; the boot-time wiring is exactly as before. It is tracked as a separate change with its own test.
• Types that appear in an exported function or type stay exported (DECISIONS-PENDING D-151). Only types used inside their own file became private.
• SQL whitespace: two erasure statements are re-indented. The statement text is identical once whitespace is normalized, which is what the transcript test compares.
• Kept although only tests use them: the anon token resolver, the IP allowance classifier, the reviewer code alias, the websocket ticket legacy branch (a security behavior) and the anon claim-code field. Removing them needs test changes; they are listed for a later PR.
• Pre-existing, unchanged: the OAuth nonce route is written by hand outside the shared registry (a contract change, ledger BE-ARCH-008); jose, arctic and @node-rs/argon2 are imported statically outside the adapters folder.
• The three request-validation helpers in the route validation module had no callers and are deleted; CLAUDE.md still mentions them (listed for the CLAUDE.md update).

User-visible copy changes

None. One unused i18n key (the old one-time-code body line) is removed from the four backend catalogs.

Tests changed

None. No test file was edited.

Verification

• Every commit typechecks on its own (api and media worker).
• At this branch: pnpm lint, prettier check, check:sql clean; api unit suite by explicit path 428 files, 7116 passed, 3 skipped; media-worker unit 300 passed, 2 failed (the known arm64 ffprobe helper issue fixed in Backend test safety net: SQL transcripts, CSRF pairing, authz and characterization tests #92).
• The offline SQL transcripts of all repository cases (the recorder from Backend test safety net: SQL transcripts, CSRF pairing, authz and characterization tests #92, run locally) are identical to Comment, em dash and emoji sweep (backend campaign 6) #95's branch.
• An adversarial review compared every changed file before and after: no behavior, security or performance change; its comment fixes are applied.
• CI runs only on PRs based on main, so it starts here when the PRs below merge and GitHub retargets this one to main.

Staging checks

• https://api.civfix.dev/readyz answers ready after the deploy (no migration in this PR).
• The regression steps above.

Not covered

• Google and Apple sign-in need test accounts on staging.
• The reviewer login (long code) is mobile-only and not enabled on staging.
• The demo seed and backfill scripts are not run on staging; their output was compared locally (same cohort for three seeds).

🤖 Generated with Claude Code