- Add NFL keys to oddsNormalizer.MARKET_MAP (defensive; same silent-zero
class as the Session 30 MLB bug) + NFL surface test
- npm audit fix: ws/qs + Supabase transitives, 7 vulns -> 0 (semver-safe)
- Audit findings documented in BUILD-STATE: grades cache has no writer,
NFL/NHL not wired end-to-end, rate limiting only on /analyze, tests
mutate a tracked jsonl, leaked GitHub PAT in origin remote (rotate)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
builtbykev