refactor: consolidate coverage and final runtime safeguards

[afoote-mitre]

Stack

6 of 6 in the 0.4.0 review stack.

• Base: af/0.4.0-review-05-contracts
• Previous: #126

Why These Changes Are Needed

The final range removes review-era duplication, consolidates tests without reducing behavioral coverage, aligns documentation with the implemented contracts, and applies the last validation/runtime safeguards found during the repository review. Keeping this cleanup last makes the preceding behavior changes easier to trace while leaving the final tree compact and documented.

Review Size

Changed lines are additions plus deletions in this PR's adjacent diff. Generated files are package-lock.json and api-docs/openapi.json; tests are *.test.js and files under test/.

Category	Changed Lines
Total	3,422
Generated files	337
Tests	2,259
Non-generated, non-test	826

Change-to-File Map

Change	Why It Is Needed	Primary Implementation Files	Test / Contract Coverage
Remove unused exports and obsolete configuration	Reduce public/internal surface area and eliminate configuration that no runtime path consumes.	utils/*.js, .env.example, config/*.jsonc	Updated utility and config/runtime-config.test.js coverage
Simplify validation and consolidate tests	Remove duplicated setup/assertions while preserving distinct malformed, boundary, and success cases.	controllers/middleware.js, routes/index.js	controllers/middleware.test.js, routes/search.integration.test.js; removes routes/cpeName.test.js after coverage migration
Consolidate controller and contract coverage	Make the large controller, delivery, contract, and OpenAPI suites easier to review and maintain without dropping behavior.	controllers/searchController.js, routes/swagger.js	controllers/searchController.test.js, test/delivery-policy.test.js, test/contract/opensearch.test.js, api-docs/openapi.test.js
Clarify bounded semantic CPE results	Explain that semantic CPE filters post-process a bounded candidate window and may produce incomplete totals beyond that window.	README.md, routes/swagger.js, generated api-docs/openapi.json	api-docs/openapi.test.js
Add strict CWE and date-range validation	Reject malformed CWE identifiers and reversed publication/modification ranges before query construction.	utils/cweId.js, controllers/middleware.js, utils/constants.js, utils/errors.js	utils/cweId.test.js, controllers/middleware.test.js, utils/errors.test.js
Enforce response-size bounds	Return an explicit bounded-response error instead of serializing payloads beyond the configured limit.	utils/searchResponseLimiter.js, controllers/searchController.js, utils/runtimeConfig.js	utils/searchResponseLimiter.test.js, controllers/searchController.test.js, utils/runtimeConfig.test.js
Apply final request/runtime safeguards	Tighten parsing order, rate-limit placement, provider failure handling, and route/controller response contracts.	server.js, routes/index.js, controllers/searchController.js, utils/searchProvider.js, utils/searchQueryBuilder.js	Server, route, controller, provider, query-builder, integration, and OpenSearch contract tests

Reviewer Focus

• Confirm test consolidation removes duplication, not distinct behavioral cases.
• Review strict CWE/date validation and response-size failure contracts.
• Confirm documentation values are derived from current constants and generated output matches source annotations.
• Compare the stack tip with af/0.4.0-codex-review; the only intentional addition is .gitattributes.