feedback5 R1: startServer and main become wiring — PORT / HOST / TRUST_PROXY and the option picks go to http/config.js, the session stack and the /ws upgrade to http/websocket.js, the request listener and /healthz to http/routes.js (new), the security headers and the clientError 400 to http/common.js, the banner, signals and entry check to http/boot.js

Same order of construction, listeners and headers as before; a scripted fingerprint (export list, 51 HTTP requests'
status / header order / body hash, raw upgrade and malformed-request replies) and the process run (banner, port in
use, SIGINT) match the pre-split server exactly. test/version.test.js reads the banner and /healthz from their new
files; module headers describe each piece.

server/http/config.js

@@ -1,5 +1,11 @@
-// server/http/config.js — the repository root and the settings the server reads from the environment
-// (TRUST_PROXY → net.js trustProxy, DEBUG → the console logger's debug level). Moved from server/index.js.
+// server/http/config.js — where the server's settings come from. startServer() options win over the environment:
+//
+//   * PORT (default 3000), HOST (default 0.0.0.0);
+//   * TRUST_PROXY ('auto' default: honour CF-Connecting-IP / X-Real-IP / X-Forwarded-For only from loopback/private
+//     peers such as a local cloudflared; '1' always; '0' never) → net.js trustProxy;
+//   * DEBUG → the console logger's debug level;
+//   * the served directories (public/, data/, shared/ of this repository unless the options name others), and which
+//     startServer() options are handed on to net.js Network and lobby.js Lobby.
 
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -9,6 +15,55 @@ export const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '
 
 export const noopLog = { info() {}, warn() {}, error() {}, debug() {} };
 
+/** startServer() options handed on to net.js Network / lobby.js Lobby (an absent one keeps that module's default). */
+const NET_OPTION_KEYS = ['reconnectWindowMs', 'heartbeatMs', 'helloTimeoutMs', 'ratePerSec', 'rateBurst', 'maxConnections', 'abuseDropsPerSec',
+  'maxConnectionsPerAddr', 'heavyPerSec', 'heavyBurst', 'trustProxy'];
+const LOBBY_OPTION_KEYS = ['lobbyGraceMs', 'maxRooms', 'maxRoomsPerAddr', 'maxMatchesPerAddr', 'resyncMinGapMs', 'soloReconnectWindowMs'];
+
+/**
+ * Where to listen: the `port` / `host` options, else PORT / HOST, else port 3000 on 0.0.0.0.
+ * @param {{ port?: number, host?: string }} opts
+ * @returns {{ port: number, host: string }}
+ * @throws {RangeError} when the port is not an integer in 0…65535
+ */
+export function listenAddress(opts) {
+  const port = opts.port ?? (process.env.PORT != null && process.env.PORT !== '' ? Number(process.env.PORT) : 3000);
+  const host = opts.host ?? process.env.HOST ?? '0.0.0.0';
+  if (!Number.isInteger(port) || port < 0 || port > 65535) throw new RangeError(`invalid PORT ${port}`);
+  return { port, host };
+}
+
+/**
+ * The directories the static server reads.
+ * @param {{ publicDir?: string, dataDir?: string, sharedDir?: string }} opts
+ */
+export function serveDirs(opts) {
+  return {
+    publicDir: opts.publicDir || path.join(ROOT, 'public'),
+    dataDir: opts.dataDir || path.join(ROOT, 'data'),
+    sharedDir: opts.sharedDir || path.join(ROOT, 'shared'),
+  };
+}
+
+/** net.js Network options out of the startServer() options; `trustProxy` falls back to TRUST_PROXY. */
+export function netOptionsFrom(opts) {
+  const netOptions = {};
+  for (const k of NET_OPTION_KEYS) {
+    if (opts[k] != null) netOptions[k] = opts[k];
+  }
+  if (netOptions.trustProxy == null) netOptions.trustProxy = parseTrustProxy(process.env.TRUST_PROXY);
+  return netOptions;
+}
+
+/** lobby.js Lobby options out of the startServer() options. */
+export function lobbyOptionsFrom(opts) {
+  const lobbyOptions = {};
+  for (const k of LOBBY_OPTION_KEYS) {
+    if (opts[k] != null) lobbyOptions[k] = opts[k];
+  }
+  return lobbyOptions;
+}
+
 /** TRUST_PROXY env → net.js trustProxy ('auto' unless explicitly on/off). @param {string | undefined} v */
 export function parseTrustProxy(v) {
   const s = String(v ?? '').trim().toLowerCase();
@@ -17,6 +72,7 @@ export function parseTrustProxy(v) {
   return 'auto';
 }
 
+/** The console logger (`quiet` → silent; debug lines only with DEBUG set). */
 export function makeLogger(quiet) {
   if (quiet) return noopLog;
   return {