chore: simplify — trim narrative comments, make eslint --cache pay off in CI (#23)

Quality
- functions/api/hello.js: drop 3-line preamble; the 405 guard is self-evident.
- functions/api/visits.js: collapse 4-line block to 2 lines, keeping the
  non-obvious WHY (GET overloaded as increment+read).
- .github/workflows/cd.yml: tighten id-token comment to one line.
- .github/dependabot.yml: collapse 3-line narration into one line that
  states the contract.
- .github/CODEOWNERS: drop 6-line preamble; the per-section comments below
  already convey scope.

Efficiency
- .github/workflows/ci.yml: add actions/cache@v4 step for .eslintcache.
  Without it, `eslint --cache` writes to a file that gets discarded every
  CI run, giving zero speedup beyond local dev. Cache key includes lockfile,
  config, and source hash so invalidation tracks real changes.

Verification
- npm test: 19/19
- npm run lint: clean

Author: heznpc

.github/CODEOWNERS

@@ -1,9 +1,5 @@
-# Code owners auto-request review on PRs touching the listed paths.
-# See https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-security/customizing-your-repository/about-code-owners
-#
-# The paths below are the security-critical surface of this starter:
-# anything that drifts here is the kind of "small fix" that quietly weakens
-# the deployed bundle. CODEOWNERS guarantees the right eye lands on the diff.
+# Auto-request review on PRs touching security-critical paths.
+# https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-security/customizing-your-repository/about-code-owners
 
 # Default catch-all
 *                                @heznpc

.github/dependabot.yml

@@ -6,9 +6,7 @@ updates:
       interval: weekly
     open-pull-requests-limit: 10
     groups:
-      # Group minor/patch updates together to reduce PR noise. Major bumps
-      # fall outside the group and arrive as individual PRs so risky upgrades
-      # are reviewed in isolation.
+      # Groups bundle minor/patch only; majors arrive as individual PRs.
       lint:
         patterns: ["eslint", "@eslint/*", "globals"]
         update-types: ["minor", "patch"]

.github/workflows/cd.yml

@@ -17,8 +17,7 @@ jobs:
     environment: cloudflare
     permissions:
       contents: write
-      # SLSA build provenance: short-lived Sigstore signing cert + write to
-      # GH attestations API. Required by actions/attest-build-provenance.
+      # Required by actions/attest-build-provenance (Sigstore + GH attestations API).
       id-token: write
       attestations: write
     steps:

.github/workflows/ci.yml

@@ -48,6 +48,17 @@ jobs:
       - name: Install dependencies
         run: npm ci --ignore-scripts
 
+      # `eslint --cache` writes to .eslintcache at cwd; persist it across
+      # runs so warm CI lints incrementally instead of rescanning the tree.
+      - name: Restore ESLint cache
+        uses: actions/cache@v4
+        with:
+          path: .eslintcache
+          key: eslint-${{ runner.os }}-${{ hashFiles('eslint.config.js', 'package-lock.json') }}-${{ hashFiles('src/**/*.js', 'functions/**/*.js', 'tests/**/*.js') }}
+          restore-keys: |
+            eslint-${{ runner.os }}-${{ hashFiles('eslint.config.js', 'package-lock.json') }}-
+            eslint-${{ runner.os }}-
+
       - name: Lint
         run: npm run lint
 

functions/api/hello.js

@@ -8,9 +8,6 @@
 const NAME_PATTERN = /^[\p{L}\p{N} _.-]{1,40}$/u;
 
 export async function onRequest(context) {
-  // This endpoint is read-only by design. Be explicit so a stray POST/PUT
-  // can't accidentally trigger code paths added later, and so monitoring
-  // can distinguish "wrong method" from "wrong payload."
   if (context.request.method !== 'GET') {
     return new Response(null, {
       status: 405,

functions/api/visits.js

@@ -21,10 +21,8 @@ const COUNTER_KEY = 'count';
 export async function onRequest(context) {
   const { env, request } = context;
 
-  // The visit counter mutates KV; reject non-GET so a misbehaving client
-  // can't drive a denial-of-service via /api/visits with unexpected verbs.
-  // (GET is overloaded as "increment + read" by convention — keep that
-  // explicit at the boundary.)
+  // GET is overloaded here as "increment + read" — reject other verbs so
+  // a misbehaving client can't drive KV writes via unexpected methods.
   if (request.method !== 'GET') {
     return new Response(null, {
       status: 405,