fix: remove any types, dead code, unused exports; add comprehensive tests

- Fix handleRotate bug ignoring Result from rotateSealedSecret()
- Fix dead code branch in useControllerHealth
- Replace all `any` types with `unknown` + type guards
- Delete unused functions/exports (452 lines removed)
- Add 18 new test files covering all hooks, libs, and components
- 233 tests passing, zero tsc errors, zero lint issues

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/lib/retry.ts

@@ -133,54 +133,3 @@ export async function retryWithBackoff<T, E>(
   // Should never reach here, but TypeScript needs it
   return Err(`Operation failed after ${opts.maxAttempts} attempts:\n${errors.join('\n')}`);
 }
-
-/**
- * Predicate to check if error is a network error (retryable)
- *
- * @param error Error to check
- * @returns true if error is network-related
- */
-export function isNetworkError(error: Error): boolean {
-  const message = error.message.toLowerCase();
-  return (
-    message.includes('network') ||
-    message.includes('timeout') ||
-    message.includes('fetch') ||
-    message.includes('connection') ||
-    message.includes('econnrefused') ||
-    message.includes('enotfound')
-  );
-}
-
-/**
- * Predicate to check if HTTP error is retryable (5xx, 429, 408)
- *
- * @param error Error to check
- * @returns true if HTTP status is retryable
- */
-export function isRetryableHttpError(error: Error): boolean {
-  const message = error.message;
-
-  // Check for 5xx server errors
-  if (/5\d{2}/.test(message)) {
-    return true;
-  }
-
-  // Check for specific retryable status codes
-  return (
-    message.includes('429') || // Too Many Requests
-    message.includes('408') || // Request Timeout
-    message.includes('503') || // Service Unavailable
-    message.includes('504')
-  ); // Gateway Timeout
-}
-
-/**
- * Combined predicate for network and HTTP errors
- *
- * @param error Error to check
- * @returns true if error is retryable
- */
-export function isRetryableError(error: Error): boolean {
-  return isNetworkError(error) || isRetryableHttpError(error);
-}