simplify-codelisted

# Simplify Code Cut complexity that does not earn its keep. Behavior-preserving: every cut is provable by the existing tests. Usable mid-Build (refactor intent) or standalone. ## Iron Rule <EXTREMELY-IMPORTANT> 1. NEVER simplify without a test suite that proves behavior before and after. 2. NEVER remove an abstraction the codebase depends on — verify call sites first. 3. NEVER add an abstraction for "hypothetical future use". One concrete user is not enough. 4. Same pattern in 3+ places enforcing the SAME rule (one invariant, one lifecycle) → centralize; text that only reads alike under a different contract stays separate. On the high-risk list — auth, billing, credits, URL validation, redirects, SSRF, cookies, logging, retries, external API — TWO occurrences already force it. 5. Deletion test before any cut: imagine deleting the module. Complexity vanishes → it was a pass-through, delete it. Complexity reappears scattered across N callers → it earned its keep, keep it. </EXTREMELY-IMPORTANT> ## Skip when - No tests cover the touched code → write them first via `implement-plan` or `debug-issue`. - The complexity is load-bearing (security boundary, data invariant). - Mid-feature and the cut is not needed to unblock the change — a required prefactor is not a skip (§4b). ## Boundary Owns: behavior-preserving cuts — inline single-use helpers, delete unused config, centralize repeated patterns, structural simplification. Does not own: feature changes · bug fixes with unkno