Go cleanup: dead code, pattern fixes, dedup, CI

[nickna]

Codebase-wide Go cleanup from a deadcode/staticcheck/manual sweep. Net −539 lines across 52 files. Four commits, ordered by risk:

1. Dead code deletion (c9bd201, −599 lines)

Everything verified unreachable from all cmd/ entry points with GOOS=linux deadcode (Linux tags matter — on Windows the carbonyl runner's callers are invisible and false-positive):

• tui/components: BrailleCanvas widget (never wired up), FlipAnimation + RenderFlipEdge (Deal/Pulse/CoinShower remain in use)
• tui/theme: BlendHex + hex-math helpers
• imaging/graphics: kitty/sixel/iterm2 encoders and Encode/EncodeWithFallback. Detect/Protocol stay (tested, plumbed through transport) — but note the detected protocol is currently a write-only session field; nothing reads it.
• doors/roulette: Payout (superseded by GrossReturn, which the coordinator uses)
• doors/roulette/multiplayer: the Registry's ctx/cancel/Stop machinery. Its doc comment prescribed a Stop()-after-Persist shutdown ordering it could never deliver (the internal context derived from main's signal context, and reg.ctx was unexported so main couldn't follow the prescribed pattern anyway). Removed; the Run context the caller passes is the real lifecycle, and the refund hook covers in-flight bets.
• auth: NoopRateLimiter (zero refs, even tests), DefaultRateLimitParams, unused dummyAlgo field, dead _ = pgx.ErrNoRows placeholder
• transport: unused Server.ListenAndServe (main serves via the netlimit-wrapped listener)
• web: requireQueries, the requestExt type, OAuthProviders.Has
• misc: chatTypingStyle, the unused stubRecorder test helper

2. Pattern fixes (b45e430)

• renderProfile header ordering: handlers called w.WriteHeader() before renderProfile, whose later Content-Type set was a silent no-op — error re-renders shipped without a charset. renderProfile now takes the status and owns the full Content-Type → WriteHeader → execute sequence; all call sites across profile/boards/chat/weather/avatar updated (boards' new-topic re-render had the same bug).
• Session ctx convention: Root.fetchStatusTempCmd used context.Background(); now sess.CtxWithTimeout(5s) so the status-bar weather fetch cancels on SSH disconnect.
• VerifyDummy recursion footgun: it round-tripped through Verify, whose unknown-format branch calls VerifyDummy — a dummy hash that ever lost its PHC prefix would recurse forever. Now calls verifyPHC directly.
• staticcheck nits: S1039, S1001, ST1005 ×2.

3. Duplication consolidation (a2aa852)

• New providers/httpjson: one GET-and-decode helper replacing ~10 hand-rolled copies (hackernews, lobsters, coingecko ×2, yahoo, frankfurter, open-meteo, nws, geocoding). Non-200 yields a typed *StatusError with a body snippet; providers keep their error prefixes by wrapping and preserve their 429 special-cases via errors.As.
• finance/news: hand-rolled rssCacheEntry mutex cache → ttlcache.Cache (same TTL + stale-on-error, gains singleflight).
• New web/cookies.go: secureCookie/expiredCookie centralize the Path/HttpOnly/SameSite/Secure attribute set used by all five cookie sites.
• web/handlers_oauth: extracted sealTokenFields from the near-identical insert/upsert token writes.
• tui/screens/chat: extracted seedChannelLog from the bootstrap/refan/local-switch handlers; the PFP-before-AppendAll ordering constraint now lives in one place, and the local-switch nil-reactions guard is preserved via an explicit flag.
• tui/screens: truncateArea/truncateRow folded into format.go (truncateRunes is the rune-aware variant; byte-based truncateRow was truncate with a worse n≤1 edge that could split a rune); handToStrings/handStrings unified.

4. CI + line endings (3add895)

• .github/workflows/ci.yml: build/vet/test/gofmt/staticcheck/deadcode on every push + PR. Linux runner is load-bearing (carbonyl build tags). No LFS checkout — the bundle is only needed by deploy.yml's docker build.
• .gitattributes: *.go text eol=lf so Windows checkouts stop making gofmt -l flag every file. All 273 .go files already store LF in the index, so no renormalization churn.

Deliberately not changed

• HTTP server ReadTimeout/WriteTimeout: /ws/bbs is a long-lived hijacked connection and the deadline interaction needs investigation first; Cloudflare fronts the HTTP surface meanwhile.
• audit.NoopRecorder: test-covered nil-object of the Recorder interface (unlike the truly orphaned NoopRateLimiter).

Verification

go build, go vet, full go test ./..., GOOS=linux go build, and GOOS=linux staticcheck ./... all clean at every commit boundary.