chore: remove lint-silenced dead code and a homoglyph identifier
The underscore prefix is the eslint unused-vars escape hatch, so `_name` marks
code kept alive purely to pass lint. Removed:
- four dead aliased imports (slide as _slide x2, fade as _fade, onMount as
_onMount, enhance as _enhance) — each appeared exactly once, at the import
- statistics/+page.svelte's write-only _loading, assigned twice and never read.
Its removal emptied the finally block, which also exposed write-only queryTime
(computed, never read) and two stale 'no longer needed' comments
- two unused _result bindings in alerts.ts; the awaits are kept, only the
discarded bindings go
routes/+page.server.ts declared `dedupeBy<U+0421>pu` using CYRILLIC CAPITAL
LETTER ES instead of Latin C. Consistent between declaration and call, so it
ran correctly — but it could not be found by grepping for dedupeByCpu, and a
homoglyph in an identifier is the shape of a review-evasion trick. Renamed to
ASCII; the file now has no non-ASCII characters at all.
Swept src/, worker/src/, packages/ and scripts/ for Cyrillic and Greek Latin
lookalikes in identifier positions; this was the only one.
The underscore declarations in analyze/+page.svelte are deliberately left for
the reactivity work, where the effect holding them is being restructured.
feat(settings): connected-app revocation, fuller export, MCP on landing and guide
- Connected Applications card in settings, listing apps authorized over OAuth
with a Revoke button that deletes both the tokens and the stored consent, so
a later authorization must be approved again rather than resumed silently.
The listing unions oauthAccessToken with oauthConsent. Reading tokens alone
left an app that had been approved but had not yet exchanged its
authorization code invisible — and therefore impossible to revoke. Caught by
driving the flow in a real browser.
- Data export now includes cloud availability alerts and their history,
notification settings, and connected applications; it predated all three. It
shares the settings helper so both report the same grants. Token and client
secret values stay out: they are the application's credentials, not the
user's data, and a downloadable file containing them would be a credential
leak.
- Export button gets data-sveltekit-reload. It is an anchor, so the client
router was starting a navigation to an endpoint that replies with a file and
never completes, leaving the loading bar animating forever.
- Landing page section and guide chapter for the MCP server, covering how to
connect, what needs an account, how to revoke, and the net-of-VAT/IPv4
pricing basis so figures read back from an assistant mean what they say.