Codebase audit: remove dead code, fix broken patterns, consolidate duplicates; v2.0.27

- Remove unused prop-types dep, deprecated useOutboundLinkTracking export
- Fix missing linkClicks key in analyticsEvents initial state (B-01)
- Export ADMIN_SESSION_COOKIE from auth.js; remove local copy in admin-auth.js (D-02)
- Remove cookieFlags() wrapper in auth.js and study-helpers.js; use cookieSecureFlag() directly (U-04)
- Remove ADMIN_SESSION_TTL_MS duplicate from config.js (D-01)
- Remove DEFAULT_SEO/DEFAULT_LEGAL/DEFAULT_REDIRECT_RULES/DEFAULT_PODCAST_FEATURED_LINKS/DEFAULT_PUBLISH_STATE
  duplicates from config.js; re-export from helpers.js (D-04, fixes sitemapPaths divergence)
- Fix email.js hardcoded fallback strings to use DEFAULT_RESEND_TO/DEFAULT_RESEND_REPLY_TO (M-02)
- Remove duplicate normalizeIp, isPrivateOrLocalIp, normalizeRedirectPath, sanitizeUrl,
  sanitizeRedirectRules bodies from study-helpers.js; re-export from helpers.js (D-03)
- Fix pruneStatsByDays to import VISITOR_RETENTION_DAYS_DEFAULT from config.js (B-02)
- Fix createTitusDownloadToken to use DOWNLOAD_TOKEN_TTL_MS constant (B-03)
- Remove normalizeMessageType duplicate from study-helpers.js (U-03/D-08)
- Remove dead wantsWelcome variable in contact.js; use shouldSendWelcome (B-04)
- Replace dynamic imports in contact.js with static imports (B-07)
- Remove dead wantsWelcome=true in study-auth.js (B-05)
- Merge duplicate import blocks in analytics.js and public.js (D-05, D-06)
- Replace dynamic readFile re-import in nuggets-host-upload.js (B-06)
- Replace hardcoded SITE_URL fallbacks with getCanonicalBaseUrl() (M-06)
- Replace raw resend.emails.send in study-account.js with sendResendEmailWithRetry (M-01)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

server/routes/study-account.js

@@ -37,6 +37,7 @@ import {
   buildBrandedEmailHtml,
   getCanonicalBaseUrl,
   getResendFromAddress,
+  sendResendEmailWithRetry,
 } from '../email.js'
 import { Resend } from 'resend'
 
@@ -381,27 +382,26 @@ export function register(app) {
         const emailChangeSubject = cfg.emailChangeSubject?.trim() || 'Confirm your new email address'
         const emailChangeBody = cfg.emailChangeBody?.trim() || 'Click the link below to confirm your new account email. If you did not request this change, ignore this message.'
         const emailChangeCtaLabel = cfg.emailChangeCtaLabel?.trim() || 'Confirm Email Change'
-        const { error } = await resend.emails.send({
-          from: getResendFromAddress(),
-          to: [newEmail],
-          subject: emailChangeSubject,
-          text: `${emailChangeBody}\n\n${verifyUrl}`,
-          html: buildBrandedEmailHtml({
-            title: emailChangeSubject,
-            eyebrow: 'Account Security',
-            bodyHtml: `<p style="margin:0 0 16px;">${escapeHtml(emailChangeBody)}</p>`,
-            ctaLabel: emailChangeCtaLabel,
-            ctaUrl: verifyUrl,
-            footerHtml: `<p style="margin:0;font-family:Georgia,serif;font-size:12px;color:#7a7060;">Verse by Verse with Nate</p>`,
-          }),
+        await sendResendEmailWithRetry({
+          resend,
+          context: 'study-account-email-change',
+          payload: {
+            from: getResendFromAddress(),
+            to: [newEmail],
+            subject: emailChangeSubject,
+            text: `${emailChangeBody}\n\n${verifyUrl}`,
+            html: buildBrandedEmailHtml({
+              title: emailChangeSubject,
+              eyebrow: 'Account Security',
+              bodyHtml: `<p style="margin:0 0 16px;">${escapeHtml(emailChangeBody)}</p>`,
+              ctaLabel: emailChangeCtaLabel,
+              ctaUrl: verifyUrl,
+              footerHtml: `<p style="margin:0;font-family:Georgia,serif;font-size:12px;color:#7a7060;">Verse by Verse with Nate</p>`,
+            }),
+          },
         })
-        if (error) {
-          console.error('[study-account] email change send error:', error)
-          res.status(503).json({ message: 'Could not send verification email right now.' })
-          return
-        }
       } catch (err) {
-        console.error('[study-account] email change send exception:', err)
+        console.error('[study-account] email change send error:', err)
         res.status(503).json({ message: 'Could not send verification email right now.' })
         return
       }