Phase 5: Code quality and tech debt (side effects, dedup, dead code, config extraction, log security)