chore: use Response.json in edge functions, drop two dead declarations

Response.json sets the JSON content type itself, so three hand-rolled
wrappers that stringified a body and spread in a Content-Type header can
delegate to it. Call sites are unchanged.

Two behavioural differences exist in principle, and neither is reachable
here:

- Response.json(undefined) throws a TypeError, where the old form produced
  an empty body. Both remaining wrappers are typed `unknown`, so this was
  worth checking: every one of the 12 call sites in import-source and the
  3 in announcements passes an object literal, never a possibly-undefined
  value.
- Response.json defers to a caller-supplied content-type, where the old form
  always overrode it. No getCorsHeaders in this repo returns one.

Verified under Deno 2.9.6 that the content type is exactly "application/json"
with no charset parameter, matching the old form byte for byte.

Also deletes two declarations with no references:

- _shared/cors.ts, a wildcard Access-Control-Allow-Origin header set with
  no importer, no import-map alias, and no config.toml entry. Every function
  defines its own getCorsHeaders origin allowlist instead, so this file was a
  misleading leftover. _shared/native-cors.test.ts is unaffected: it iterates
  a hardcoded list of function names and reads ../<name>/index.ts as text, so
  it never enumerates _shared or asserts on this file.
- the local Source type in ai/index.ts, never exported and never used.

Verified on main fe679fd, from a clean npm ci: docs:check, lint, typecheck,
956 unit tests, 121 edge tests, deno check on the 4 touched function
entrypoints, build, and 126 Chromium e2e tests pass.

Author: Programcode

supabase/functions/_shared/cors.ts

@@ -81,10 +81,7 @@ function getProviderForModel(model: string): "openai" | "google" | "anthropic" |
 }
 
 function jsonResponse(body: Record<string, unknown>, status: number, corsHeaders: Record<string, string>) {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { ...corsHeaders, "Content-Type": "application/json" },
-  });
+  return Response.json(body, { status, headers: corsHeaders });
 }
 
 function sse(event: string, payload: Record<string, unknown>) {

supabase/functions/ai-stream/index.ts

@@ -27,13 +27,6 @@ function getCorsHeaders(origin: string | null) {
 
 type Feature = "generate" | "attack" | "brainstorm" | "factoids" | "ask" | "sparring" | "crossfire";
 
-type Source = {
-  title: string;
-  content: string;
-  origin?: string;
-  type: string;
-};
-
 // Generate unique request ID for tracing
 function generateRequestId(): string {
   return `edge_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;

supabase/functions/ai/index.ts

@@ -23,10 +23,7 @@ function getCorsHeaders(origin: string | null) {
 }
 
 function json(data: unknown, status: number, corsHeaders: Record<string, string>) {
-  return new Response(JSON.stringify(data), {
-    status,
-    headers: { ...corsHeaders, "Content-Type": "application/json" },
-  });
+  return Response.json(data, { status, headers: corsHeaders });
 }
 
 Deno.serve(async (req) => {

supabase/functions/announcements/index.ts

@@ -33,10 +33,7 @@ const supabaseServiceKey = Deno.env.get("SUPABASE_SERVICE_ROLE_KEY")!;
 const supabase = createClient(supabaseUrl, supabaseServiceKey);
 
 function jsonResponse(body: unknown, status: number, headers: Record<string, string>) {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { ...headers, "Content-Type": "application/json" },
-  });
+  return Response.json(body, { status, headers });
 }
 
 async function isUserBanned(userId: string): Promise<boolean> {