refactor-pass

# Refactor Pass Inspect the task-owned diff, nearby source, and tests. Remove unnecessary work, clarify control flow, and reuse existing helpers where it improves clarity. Preserve unfamiliar guards until source/history establishes their purpose. Preserve observable behavior, public types, error contracts, privacy, and boundary validation. Avoid unrelated formatting and new dependencies for routine cleanup. Use `docs/agent-playbooks/verification.md` to choose affected checks. For moderation code, retain strict Zod parsing, stubbed provider calls in tests, hashed cache identities without raw secrets/content, and fail-closed error handling. Consolidate provider/cache helpers only when their contracts match.