refactor(auth-ui): waste & duplication reduction (audit phases 1–5)

[yahyafakhroji]

Summary

Codebase-wide waste / duplication / inefficiency reduction, driven by a multi-agent audit (47 findings → 45 verified, 2 false positives rejected) and executed in 5 dependency-ordered phases, each its own commit(s) and independently verified.

Outcome: −363 LOC of production code removed/deduplicated, +18 characterization tests (1310 → 1328), no coverage lost, no behavioral changes.

Phases

Phase	Commit(s)	What
1 — pure deletes	ff8763ee	dead barrels (server/edge/index.ts, server/infra/index.ts), stale en.js, withCsrf/getHints/setupI18n/capSessions, dead toSession.challenges branch, unused deps (ioredis, 2× otel direct), resource-barrel trim
2 — adopt existing helpers	ad61317b	loaderCsrf×18, LastUsedBadge×3, withPasswordMatch×4, slugify dedupe, useLoginContext×7, login-loader Promise.all
3 — small extractions	9e2cb340	readCeremonyParams, redirectToLogin, BrandLogo, IdpButtonList/OrDivider, threadParams, authorizeHandbackTarget/ssoErrorRedirect, AuthFormFields×9
4 — service consolidation	b41d164c, b4fde974	sessionEntryFromSession (10 creation sites), createRateLimit factory + lastHopIp
5 — parameterized merges (TDD-first)	190d1d01, 2230d78f, 2dd7e9bd, fd293b2a, cea23a47	nextStepFromSession, enumeration-safe register, webauthn enrollment cfg factory, timestampToIso

Behavior preservation

These are refactors only — no functional changes. The riskier merges (Phase 5) were done TDD-first: characterization tests pinning the current behavior (incl. the subtle divergences) were written and confirmed green on the un-refactored code before each merge. Divergences deliberately preserved, e.g.:

• completeEmailLinkSignup keeps id: session.id but token/timestamps from the post-update verified object.
• nextStepFromSession takes the divergent values (fresh mfaInitSkippedAt, raw loginName) as caller-resolved inputs; session.service left bespoke (its overrides are not session-derived).
• register audit events stay distinct (signup.requested vs signup.created); rate-limit named exports + IP fallbacks ('unknown' vs '') unchanged; tsToIso('') empty-string passthrough preserved.

Verification

• Every commit gated by lefthook (prettier/eslint/i18n/typecheck/unit).
• Independent re-verification at HEAD: tsc clean · 1328/1328 tests · prod build ✓.
• Two adversarial code-reviews (Phases 1–3 and 4–5): both APPROVE — no behavioral regressions found.

Test plan

• bunx tsc --noEmit
• bun run test:unit (1328 passing)
• bun run build
• CI green on this PR

[github-actions]

🧪 Test Summary

Job	Status
E2E (fast, fake provider)	✅ success
Unit Tests	✅ success

View workflow run