refactor: close the structural findings from the architecture review

[Isma-L154]

Closes the rest of #81 — F2, F3 (remainder), F5, F6, F7 — and reaches a different conclusion on F9 than the review did.

F2 · The e2e suite could run against another application

It listened on 5173, the port every Vite project takes by default, and reuseExistingServer adopted whatever was already there without checking whose it was. That is how seventeen tests once failed against a stranger's HTML, pointing at robots.txt and security headers rather than at anything real. The dangerous direction is the other one: a reused server running stale code reporting green.

Now a port nothing else defaults to, plus --strictPort — without it Vite answers a busy port by quietly moving to the next one, which would leave the suite pointed at nothing.

F3 · Six exports made private

Each checked against its spec first, because several siblings are public precisely so they can be unit-tested and those must stay: DELETION_WARNING_DAYS, watchableSeasons, MAX_SEEDS, MAX_RAILS, MAX_RAIL_ITEMS, SHARE_SCOPES, CALLBACK_PATH.

F5 · Components no longer type against the database schema

WatchlistCard and ContinueWatching took WatchlistItem from $lib/server/db/schema. Type-only, so nothing ever shipped to the browser — but presentation depended on the persistence shape, and adding a column changed the type a card saw.

They now take SavedTitle, owned by the domain: what the rules need, plus the three things only a rendering cares about. The database row satisfies it structurally, so nothing converts anything. The proof it was real coupling: the card's own fixture lost userId, overview and addedAt — three fields it never used and should never have been asked for.

F6 · watchlistActions split

485 lines and four reasons to change → the titles (list.ts), the links that publish them (sharing.ts), the account's own settings (settings.ts), spread back into one map in index.ts.

The route contract is untouched: all 55 action tests pass unedited, and the spec's import('./actions') resolves to the new index on its own.

F7 · tmdb.ts split

612 lines and six endpoint families whose only genuinely shared parts are the fetch and two raw response shapes. Those are client.ts; search, seasons, details, recommendations, trending and people each have their own file behind an index that re-exports the same public surface. No import anywhere else changed.

F9 · The review's number was wrong, and so was its conclusion

I have to correct this rather than act on it. The 46% figure came from a counter with a bug: entering an HTML comment <!-- … --> it only looked for */ to exit, so it swallowed the rest of every Svelte file as comment. The "82% files" were an artifact of that.

Measured correctly:

	claimed	actual
Whole codebase	46%	35%
Worst files	MediaCard.svelte 82%	domain/filmography.ts 65%

And the real top files are not components — they are filmography.ts, db/schema.ts, title-url.ts, domain/share.ts: files that document why a tuning constant is the value it is (why five credits, why twenty, why eight people). That is the kind worth keeping, and a sweep would have destroyed it.

A targeted hunt for comments that merely restate their code found essentially nothing beyond SvelteKit's own scaffolding in app.d.ts.

So no sweep. What was genuinely bloated was prose in markup, and MediaCard had two thirteen-line essays. Both are now five and six lines with every fact intact — the blur ban still carries its measurement (794ms → 392ms over 300 frames, 154 compositing layers), the clamp note still names both reasons it cannot move to the button. 32 comment lines removed, and the file is the better for it; the codebase moved 36% → 35%, which is the honest size of this.

Verified

• npm run check — 0 errors, 0 warnings; npm run lint clean
• 488 unit tests pass, none edited — that is the point of a mechanical split
• 17 e2e pass, on the new port, without touching the dev server on 5173
• Every TMDB family exercised over real HTTP after the split: search, trending, details+seasons, person, and the public title page
• Every one of the 12 actions exercised after the split, including the bodyless ones, plus the 401 guard on all three modules and the "isn't out yet" rule still refusing
• Driven in a browser: list, progress bars, Continue Watching, share panel, release pill. No console errors.