refactor: simplify admin code — extract shared helpers, fix quality issues

- Extract KEBAB_RE, SESSION_COOKIE, SESSION_MAX_AGE_MS, COOKIE_MAX_AGE,
  authRequest(), and sessionResponse() to auth.ts — eliminating 4 copies
  of the auth() wrapper and 3 copies of KEBAB_RE across admin API routes
- Remove timing side-channel: drop a.length !== b.length early-return
  before timingSafeEqual in verifySession (SHA-256 HMAC always 64 chars)
- Fix YOLO localStorage write-before-read race using initialization guard
- Fix admin layout /api/ bypass to return {} instead of {authenticated:true}
- Extract extractError() helper in admin page — removes 4 inline patterns
- Parallel Promise.all in admin loadData() — halves round-trip latency
- Parallel Promise.all in moveCheckedUnits() + surface per-request errors
- Hoist Big(inputValue) above .map() in converter — one alloc per recompute
- O(n) single-pass orderedResults using Map instead of O(n*groups) filters
- Fix expandedGroups.add() mutation — use Set assignment for consistency

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/routes/admin/api/groups/[id]/+server.ts

@@ -1,15 +1,11 @@
 import { json } from '@sveltejs/kit';
-import { loadData, saveData, loadConfig } from '$lib/server/data';
-import { requireAuth } from '$lib/server/auth';
+import { loadData, saveData } from '$lib/server/data';
+import { authRequest } from '$lib/server/auth';
 import type { RequestHandler } from './$types';
 import type { Group } from '$lib/types';
 
-function auth(request: Request) {
-  return requireAuth(request, loadConfig());
-}
-
 export const PUT: RequestHandler = async ({ request, params }) => {
-  if (!auth(request)) return json({ error: 'Unauthorized' }, { status: 401 });
+  if (!authRequest(request)) return json({ error: 'Unauthorized' }, { status: 401 });
 
   const { id } = params;
   const body = await request.json().catch(() => null);
@@ -35,11 +31,7 @@ export const PUT: RequestHandler = async ({ request, params }) => {
     // Then set new base unit toBase = 1.0
     for (const unit of data.units) {
       if (unit.group === id) {
-        if (unit.id === newBaseId) {
-          unit.toBase = 1.0;
-        } else {
-          unit.toBase = unit.toBase / X;
-        }
+        unit.toBase = unit.id === newBaseId ? 1.0 : unit.toBase / X;
       }
     }
   }
@@ -52,7 +44,7 @@ export const PUT: RequestHandler = async ({ request, params }) => {
 };
 
 export const DELETE: RequestHandler = async ({ request, params }) => {
-  if (!auth(request)) return json({ error: 'Unauthorized' }, { status: 401 });
+  if (!authRequest(request)) return json({ error: 'Unauthorized' }, { status: 401 });
 
   const { id } = params;
   const body = await request.json().catch(() => ({}));
@@ -96,11 +88,10 @@ export const DELETE: RequestHandler = async ({ request, params }) => {
         unit.group = targetGroupId;
       }
     }
-  } else if (action === 'orphan') {
+  } else {
+    // orphan
     for (const unit of data.units) {
-      if (unit.group === id) {
-        unit.group = null;
-      }
+      if (unit.group === id) unit.group = null;
     }
   }