chore: code-quality pass — extract dashboard, agent loop, rate-limit login

[victalejo]

Summary

• Structure: extract dashboard HTML (~300 lines) from app.ts into src/views/dashboard.ts; move the Instagram agent loop out of app.ts (it was a module-load side-effect) into src/agentLoop.ts, started explicitly from index.ts. app.ts shrinks from 422 → 64 lines and is now safely importable in tests.
• Security: add a zero-dependency in-memory rate limiter (src/utils/rateLimit.ts) and apply it to POST /api/login (10 attempts / 15 min per IP). Returns 429 + Retry-After when exceeded.
• Tests: +6 integration tests over the real Express app (src/routes/api.test.ts) covering /api/status, /api/health, /api/me, /api/login validation + rate limit, and /dashboard. +4 unit tests for the rate limiter. Total suite: 11 suites / 33 tests passing.
• Tooling:
  • Migrate ESLint v10 to flat config (eslint.config.js); drop deprecated .eslintrc.cjs and .eslintignore.
  • Fix pre-existing @typescript-eslint/no-unsafe-function-type error in requireAuth (Function → NextFunction).
  • package.json scripts: split build/serve/clean/dev; start now just runs build && serve; add test:coverage.
  • jest.config.cjs: configure collectCoverageFrom, exclude views/, app.ts, index.ts, and the recaptcha subproject.
• Cleanup: delete empty/orphan files src/server.ts, src/client/Twitter.ts, src/client/Github.ts, src/twitterAgent.js, riona-tweet.js.

Why

• app.ts was acting as entrypoint + dashboard view + agent runtime, which made it untestable and hard to read.
• /api/login had no protection against brute-force.
• ESLint was broken on this branch (v10 needs flat config), so npm run lint failed before any change could be vetted.