refactor(server): remove legacy administration surfaces

[echobt]

Summary

• Remove eight unused /api/v1/admin/* routes and their 697-line module, obsolete role/profile helpers, and unused network-proxy admin settings.
• Preserve JWT/API-key authentication, all 40 CLI command declarations, ordinary sessions/sharing, automatic share expiry, and network/sandbox protections. Add negative-route, JWT validation, legacy-claims, command-tree, and proxy-policy regressions.
• Document the intentional administration API/config compatibility changes. This PR contains only the cleanup, on top of the squash-merged readiness PR feat(readiness): add quality gates and harden local runtime #22: 10 files, 217 additions, 887 deletions.

Test plan

• cargo fmt --all -- --check
• ./scripts/clippy.sh
• cargo test --locked --offline --workspace --no-fail-fast: 6,180 passed, 0 failed, 212 ignored across 139 suites, including doctests.
• TUI/headless suites included in workspace validation; no TUI surface or rendering change.
• cargo audit with existing policy; the pre-existing GitHub Dependabot alert feat(harness): align CLI with keep-set, Task, and Code agent API #2 is not resolved by this cleanup.
• Source/dependency policy, dependency release age, version consistency, and generated contracts verified. 28 Python policy/workflow tests pass; no new source-policy regressions.
• 15 real loopback functional/security QA cases and nine real CLI help checks pass; no live coding-service call.
• Focused recheck against the fetched, squash-merged main: 12 router tests, 22 proxy tests, three CLI schema tests, formatting, policy and coverage pass.
• Changed production coverage against the actual PR base 1de74fb16460b1a9b79513db18d9e02ae3431808: 1/1 executable line covered, no absent production source. Most changes are deletions or tests. The earlier 745/873 figure included readiness changes against an older base and is not this PR's denominator.
• GitHub CI: 12/12 checks successful on exact head 72850424c11d8061d072edc260d23c53274393da, run 34100633310.
• Greptile review: explicitly requested; the application is installed, but no review or findings have been received yet.

Attestation (required)

• Security reviewed: authentication, removal boundaries, legacy claims, network settings, and unchanged exec/sandbox protections were reviewed. No secrets or keyring dumps are included.
• Product-facing errors: existing Cortex error handling is retained; no new raw provider/transport messages.
• TUI verified: no TUI surface was changed; existing headless workspace suites pass. No authenticated live TUI/model turn is claimed.
• Tests added: real router behavior and serialization/command-tree regressions cover the removal; no mock-success paths.
• No secrets: no API keys, credentials, .env files, diagnostic journals, aggregates, or build artifacts are included.

Risk

Intentional API removal: the eight administration routes return 404 after authentication, while unauthenticated requests still receive 401 when authentication is enabled. Removed Rust administration types/fields/helpers are source-level API changes. Legacy JWT role/profile claims are ignored and cannot confer privileges. Old proxy admin fields deserialize as unknown fields and no longer serialize.

The server remains an authenticated operator workspace, not a mutually untrusted multi-tenant sandbox. Full coding-feature parity and non-Linux/live-service behavior are not established by this cleanup. No merge or release is requested.

[echobt]

@greptileai please review this PR.