refactor-detector

Found 3 future-regret signals:

[high]   src/auth/session.ts:88
         "isAdmin" is set on the request object but read in 4 places.
         Implicit state. Future you will spend 40 minutes finding the writer.
         Suggested: pass it explicitly through args, or wrap in a typed context.

[medium] src/api/billing.ts:204
         New helper "normalizeAmount" takes 5 params, 3 of them booleans.
         Boolean-explosion smell. Six months from now this will have 7 params.
         Suggested: split into normalizeAmount and convertAmount.

[low]    src/utils/dates.ts:12
         Comment says "returns ISO8601" but function returns ms timestamp.
         The function works. The comment lies. The comment will outlive the
         memory of why it lied.