chore: act on the unambiguous findings from the architecture review

[Isma-L154]

Part of #81 — the four findings that needed no judgement call. The full review is in the issue.

Deliberately not here: the layering leak (F5), the two oversized modules (F6, F7), the test-server footgun (F2) and the comment density (F9). Those are questions about structure and house style — they belong to you, not to a cleanup commit.

---

F1 · Runtime dependencies were declared as dev dependencies

dependencies was empty. arctic signs users in; drizzle-orm and @libsql/client reach the database.

It worked only because everything is bundled at build time, so nothing is resolved at runtime. It breaks on any install with --omit=dev, and it quietly files every advisory against those three packages as a development-only risk. Lockfile regenerated — verified npm ci still resolves, and that all three now record as production rather than dev.

F3 · Two dead exports

• RATE_LIMIT was never read. The real ceiling lives on the Cloudflare binding in wrangler.jsonc, so the constant was a copy of configuration free to drift from it with nothing to notice.
• loadShareSettings arrived with the share feature and was never wired up — My List reads those columns inline. It and the suite that only exercised it both go, which is why the test count moves 490 → 488.

The seven module-private-but-exported symbols from F3 are not touched: several of their siblings are public specifically so they can be unit-tested, and telling those apart is a per-symbol judgement, not a sweep.

F4 · The clipboard fallback existed three times

CalendarFeed, ShareList and ShareButton each carried their own copy, and the wording had already started to drift between them.

What is genuinely shared is the write and the sentence said when a browser refuses it. What differs is how each caller gets the text in front of the reader — so that is a callback rather than a field. ShareButton needs that: unlike the two panels, it has no field on screen until the clipboard has actually refused, so revealing one is part of its fallback.

F8 · worker-configuration.d.ts marked generated

Not refactored — the review's conclusion is that it is correct as it stands. It is wrangler output: 17 lines of this project's bindings inside 14,801 lines of workerd typings pinned to the compatibility date. linguist-generated=true keeps it out of diffs and out of the language breakdown.

Corrected after merge: this originally said npm run check would fail without the file. It does not — it exits 0 with a warning. What actually happens is that Env stops resolving and every binding access goes unchecked behind a green build, which is a better reason to keep it. See the correction on #81.

---

Verified

• npm run check — 0 errors, 0 warnings; npm run lint clean
• 488 unit tests pass; 17 e2e pass
• npm ci resolves against the regenerated lockfile
• Driven in a real browser, both paths of all three copy controls — a working clipboard and a refused one:

	success	refusal
Share panel	wrote the URL, correct toast	field selected, Ctrl/Cmd toast
Calendar feed	wrote the .ics URL, correct toast	field selected, Ctrl/Cmd toast
Share button	wrote the canonical title URL, field stayed hidden	field revealed, showing the URL, text selected

No console errors.