chore: remove dead scaffolding + guard GPC cookie clear (audit cleanup)

[MP2EZ]

Summary

Cleanup from `/m:audit --bloat` + the one `--performance` finding. All cuts are scaffolding for code paths the architecture deliberately doesn't use — zero behavior change. Net −121 LOC.

Dead code removed (bloat findings)

Item	File	Why it's dead
trackConversion() + ConversionEvent	lib/ab-testing.ts	Only console.log'd in dev. Real conversion tracking is the variant written to Notion in the waitlist route — the function's own comment admitted this.
getGpcFromCookie()	lib/gpc.ts	Exported "for Server Components" but zero production callers. GPC is read client-side (AnalyticsGate, GpcNotice) and request-side (middleware). Removing it also drops the only next/headers cookies() import.
POSTHOG_ASSETS_HOST	lib/posthog/config.ts	Exported, never imported. CSP uses literal strings; init() only sets api_host.
phase-2-in-comments + restating JSDoc	lib/posthog/events.ts, lib/gpc.ts	"Ships in PR #2" belongs in the tracker; JSDoc that restates the signature. Kept the @see INFRA-* refs and load-bearing compliance comments.

Plus the corresponding tests for the deleted functions (6 tests removed).

Performance finding (PERF-01)

middleware.ts cleared the being_gpc cookie on every non-GPC request — emitting a Set-Cookie on ~all traffic, which defeats shared/CDN caching of HTML responses. Now guarded:

} else if (request.cookies.has(GPC_COOKIE_NAME)) {
  response.cookies.delete(GPC_COOKIE_NAME);
}

Only emits the clearing Set-Cookie when there's actually a stale cookie to clear. Updated the middleware test: clears-when-present + new does-not-emit-when-absent.

Bonus: .gitignore fix

/.open-next/ (the 27MB OpenNext Cloudflare build output) was untracked-but-not-ignored. A local opennextjs-cloudflare build pollutes git status and makes eslint glob 12k+ generated files (it bit this very cleanup — a stray build produced 469 phantom lint errors). Pre-existing gap, fixed here. /.next/ was already ignored; .open-next was just missed.

Verification

• All 4 deleted symbols confirmed zero remaining refs (grep)
• npm run lint — clean
• npm run typecheck — clean
• npm test — 75 pass (was 80: −6 dead-path tests, +1 new middleware test)
• npm run build — all 17 routes static

Relationship to #44

Independent of the security PR (#44, dep updates) — different files, no conflict. Either can merge first.

🤖 Generated with Claude Code