refactor(server): remove legacy administration surfaces

docs/reference/app-server.md

@@ -41,12 +41,23 @@ The supported contract covers:
 | GET, DELETE | `/sessions/{id}` | Read/delete an in-memory session |
 | POST, GET | `/sessions/{id}/messages` | Store/list messages, no model inference |
 
-Other development endpoints, including files, terminals, admin, SSE, and
+Other development endpoints, including files, terminals, SSE, and
 WebSockets, are not yet part of this stable schema. Authentication applies to
 them too. A configured server API key is an operator credential, not a
-multi-tenant sandbox. JWT admin routes require the `admin` role; ordinary
-authenticated routes operate on the server's workspace. Do not host mutually
-untrusted tenants in one process.
+multi-tenant sandbox. Authenticated routes operate on the server's workspace.
+Do not host mutually untrusted tenants in one process.
+
+The legacy `/api/v1/admin/*` API has been removed, including global statistics,
+bulk session operations, CSV exports, and share administration. These paths
+return 404 after authentication; unauthenticated requests still fail authentication.
+Legacy JWT role/profile claims are ignored and grant no additional capabilities.
+Use the existing CLI session, export, and stats commands for your own local data.
+Session sharing and automatic expired-share cleanup remain available.
+
+The unused network-proxy `admin_url` and
+`dangerously_allow_non_loopback_admin` settings have also been removed. Older
+configuration files may still contain these unknown fields, but they have no
+effect. Proxy domain/IP filtering, network modes, and sandbox protections remain.
 
 Send `Authorization: ApiKey <server key>` or `Authorization: Bearer <JWT>`.
 JWTs require issuer `Cortex` and audience `cortex-api`.

scripts/readiness/qa.py

@@ -84,8 +84,16 @@ def call(method, path, body=None, authenticated=True, headers=None):
                     pass
                 check(time.monotonic() < deadline, "Local server readiness timed out")
                 time.sleep(.1)
-            for path in ["/sessions", "/metrics", "/admin/stats", "/ws", "/health/sessions"]:
+            for path in ["/sessions", "/metrics", "/ws", "/health/sessions"]:
                 check(call("GET", path, authenticated=False)[0] == 401, "Authentication boundary failed")
+            for method, path in [
+                ("GET", "/admin/stats"), ("GET", "/admin/stats/sessions"),
+                ("GET", "/admin/stats/usage"), ("GET", "/admin/sessions"),
+                ("POST", "/admin/sessions/bulk"), ("GET", "/admin/sessions/export"),
+                ("GET", "/admin/shares"), ("POST", "/admin/shares/cleanup"),
+            ]:
+                body = {"session_ids": [], "action": "delete"} if method == "POST" else None
+                check(call(method, path, body)[0] == 404, "Removed administration endpoint remains available")
             check(call("GET", "/sessions", headers={"Authorization": "ApiKey invalid-fixture"})[0] == 401, "Invalid key was accepted")
             status, headers, session = call("POST", "/sessions", {"model": "local-qa"})
             check(status == 200, "Session creation failed")
@@ -132,7 +140,7 @@ def call(method, path, body=None, authenticated=True, headers=None):
         "server.local_readiness", "server.authentication", "server.session_crud",
         "server.message_storage", "server.correlation", "server.metrics",
         "dast.body_limit", "dast.cors", "dast.workspace_traversal", "dast.symlink_escape",
-        "server.file_crud", "dast.file_mutations",
+        "server.file_crud", "dast.file_mutations", "dast.removed_admin_routes",
     ]
 
 def run(bin_dir):