Fix code smells

LaDOSE.Src/LaDOSE.WebApp/README.md

@@ -46,7 +46,7 @@ DTO field surfaces as a TypeScript error rather than a runtime 404.
 | `src/lib/api/schema.d.ts` | Generated types — all 31 API paths and every DTO |
 | `src/lib/api/schema-helpers.ts` | Friendly aliases (`ApplicationUserDTO`, `LoginRequest`, …) |
 | `src/lib/api/client.ts` | `apiRequest` — bearer auth, JSON, `ApiError`; paths constrained to real routes |
-| `src/lib/api/users.ts` | `login` / `register` against `/Users/auth` and `/Users/register` |
+| `src/lib/api/users.ts` | `login` against `/Users/auth` — the one unauthenticated call |
 | `src/lib/api/errors.ts` | `toErrorMessage` — message to show, or redirect to `/login` on a 401 |
 | `src/lib/api/tournaments.ts` | `listEvents` / `importSmashTournament` / `getResults`, authenticated from the session |
 | `src/lib/api/games.ts` | `listGames` / `saveGame` / `deleteGame` / `searchSmashGames` |
@@ -223,7 +223,8 @@ otherwise only reachable through the database.
 Lists every account with its roles, creates accounts, and deletes them.
 
 `POST /Users/register` used to be `[AllowAnonymous]` so that the first account could be
-created. It is now `POST /Users/AddUser` and requires the **Admin** role, so before this
+created. That route is gone; account creation is now `POST /Users/AddUser` and requires
+the **Admin** role, so before this
 page is reachable at all, one account has to be promoted directly in the database:
 
 ```bash
@@ -266,5 +267,11 @@ How roles work:
 
 ```bash
 npm run check    # svelte-check (types + template diagnostics)
+npm run lint     # eslint, including type-aware rules
+npm run test     # vitest over the pure modules in $lib
 npm run build    # static build into ./build
 ```
+
+`npm run test` covers `$lib/statistics`, `$lib/tournaments`, `$lib/games/draft` and the
+small shared helpers beside them (`csv`, `events`, `format`). Those modules are pure by
+design, so they run under plain Node with no API and no database.