Codebase audit: remove dead code, fix broken patterns, consolidate duplicates; v2.0.27

- Remove unused prop-types dep, deprecated useOutboundLinkTracking export
- Fix missing linkClicks key in analyticsEvents initial state (B-01)
- Export ADMIN_SESSION_COOKIE from auth.js; remove local copy in admin-auth.js (D-02)
- Remove cookieFlags() wrapper in auth.js and study-helpers.js; use cookieSecureFlag() directly (U-04)
- Remove ADMIN_SESSION_TTL_MS duplicate from config.js (D-01)
- Remove DEFAULT_SEO/DEFAULT_LEGAL/DEFAULT_REDIRECT_RULES/DEFAULT_PODCAST_FEATURED_LINKS/DEFAULT_PUBLISH_STATE
  duplicates from config.js; re-export from helpers.js (D-04, fixes sitemapPaths divergence)
- Fix email.js hardcoded fallback strings to use DEFAULT_RESEND_TO/DEFAULT_RESEND_REPLY_TO (M-02)
- Remove duplicate normalizeIp, isPrivateOrLocalIp, normalizeRedirectPath, sanitizeUrl,
  sanitizeRedirectRules bodies from study-helpers.js; re-export from helpers.js (D-03)
- Fix pruneStatsByDays to import VISITOR_RETENTION_DAYS_DEFAULT from config.js (B-02)
- Fix createTitusDownloadToken to use DOWNLOAD_TOKEN_TTL_MS constant (B-03)
- Remove normalizeMessageType duplicate from study-helpers.js (U-03/D-08)
- Remove dead wantsWelcome variable in contact.js; use shouldSendWelcome (B-04)
- Replace dynamic imports in contact.js with static imports (B-07)
- Remove dead wantsWelcome=true in study-auth.js (B-05)
- Merge duplicate import blocks in analytics.js and public.js (D-05, D-06)
- Replace dynamic readFile re-import in nuggets-host-upload.js (B-06)
- Replace hardcoded SITE_URL fallbacks with getCanonicalBaseUrl() (M-06)
- Replace raw resend.emails.send in study-account.js with sendResendEmailWithRetry (M-01)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

server/routes/nuggets-host-upload.js

@@ -10,6 +10,7 @@ import {
   sendNuggetsUploadNotification,
   sendNuggetsHostWelcomeEmail,
   sendNuggetsHostOtpEmail,
+  getCanonicalBaseUrl,
 } from '../email.js'
 import { markSeafileFileSeen } from '../nuggets-seafile-watcher.js'
 import {
@@ -414,8 +415,7 @@ export function register(app) {
     }
 
     try {
-      const { readFile: rf } = await import('node:fs/promises')
-      const fileBuffer = await rf(tempPath)
+      const fileBuffer = await readFile(tempPath)
 
       // Upload audio to /Episode Upload/
       const audioLink = await getSeafileUploadLink(SEAFILE_EPISODE_UPLOAD_DIR)
@@ -553,7 +553,7 @@ export function register(app) {
       name,
       username: email,
       password,
-      portalUrl: `${process.env.SITE_URL ?? 'https://versebyversewithnate.us'}/host`,
+      portalUrl: `${getCanonicalBaseUrl().replace(/\/$/, '')}/host`,
     }).catch(err => console.error('[nuggets-host] welcome email error:', err))
 
     const { passwordHash: _ph, ...safeHost } = host
@@ -591,7 +591,7 @@ export function register(app) {
         name: data.hosts[idx].name,
         username: data.hosts[idx].email,
         password: newPassword,
-        portalUrl: `${process.env.SITE_URL ?? 'https://versebyversewithnate.us'}/host`,
+        portalUrl: `${getCanonicalBaseUrl().replace(/\/$/, '')}/host`,
       }).catch(err => console.error('[nuggets-host] reset email error:', err))
     }