fix: four more findings from the audit

[PastaPastaPasta]

Summary

The remaining items from the audit's bug list, each pre-existing.

• Settings promised things that did nothing. The Privacy section had "Public Profile" and "Show Activity Status" switches backed by local state nothing read, and the Account section had a "Delete Account" button whose only effect was a toast saying deletion is not implemented. Profiles on a public chain cannot be made private and accounts cannot be deleted, so the controls are removed rather than left implying otherwise. The Link Previews switch and everything else on the page is untouched.
• Avatar-settings hook could show the previous user's avatar. useAvatarSettings had no cancellation, so a slow load for user A landing after the hook switched to user B overwrote B's settings. A request counter now drops stale results.
• Price refetch ran twice. useCryptoPrice kept skipCache in state and listed it as an effect dependency, so refetch() ran the effect once with the bypass and again when the flag reset. The flag is a ref read once per run.
• DMs could stack duplicate invites. getMyInviteToRecipient returned null both for "no invite" and "lookup failed", so any transient query error made sendMessage create another conversationInvite (a paid write). Failure is now undefined and skips creation; a missing invite costs one inbox hint, a duplicate costs credits each time.

Left as they are, deliberately: hasPrivateFeed and getLatestEpoch return a safe default on error. Nine callers rely on the fail-soft answer and the epoch callers only compare chain against local, so a false default can delay a sync but not corrupt anything.

Part of the anti-slop cleanup series (after #370–#391).

Test plan

• npm run lint (zero warnings), tsc --noEmit, npm run test, npx knip, npm run build all green locally
• CI
• Manual: Settings → Privacy shows Link Previews and the key-backup block only; Account has Log Out only; avatar customisation while switching accounts; checkout price refetch fires one request; send a DM with the network briefly failing and see one invite

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying yappr-v2 with    Cloudflare Pages

Latest commit:	d1ff622
Status:	⚡️  Build in progress...

View logs

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 5477cd55-8503-45e0-808a-1586bf3ec42e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}