finish the offscale sweep: two real remnants and eleven stale names

Asked for a thorough check that nothing of offscale is left in the platform. The
extraction was sound — no router, no permission entry, no app-store entry, no
screen, no panel app, no env var anything reads. Two things were genuinely wrong,
and both were in setup rather than in the server.

── The secret store minted a key for a plugin ──

`officer-setup` bootstrapped two purposes: `jwt` and `headscale`. The second was a
key for a PLUGIN, under a name the rename had already replaced, on a machine where
the plugin is not installed and nothing would ever ask for it. offscale encrypts
under `offscale`, and `getKey` creates on demand — which is precisely what lets
core know nothing about plugins. Now core bootstraps `jwt` alone.

── `.env.example` documented variables for a deleted router ──

HEADSCALE_URL, HEADSCALE_API_KEY and HEADSCALE_USER were described as driving
`/api/vpn`. That router was deleted on 2026-08-14 and nothing has read any of them
since. Left as a note saying where the tailnet's credentials live now, because
somebody with an older `.env` will otherwise wonder why setting them does nothing.

── Names that outlived the thing ──

Eleven comments referred to the plugin's route, panels, console or server registry
as "headscale": three sidecar config files describing their own shape by pointing
at it, two screens citing `/headscale` as the example of a Workspace/Panel route,
the terminal's note about the Console, and the photos types. Also `catalogue.ts`,
which still claimed headscale "is CORE now", and `working-on-officer.md`, which
told the reader a core install runs six processes including `officer-headscale`.

Upstream references are deliberately untouched: "Headscale's API", "the Headscale
admin credential", "is this a Headscale server?" all name the thing the plugin
drives, and renaming those would make the sentences false.

`docs/secret-store.md` argued headscale must be core because the tailnet is the
perimeter. Marked superseded rather than deleted, with the distinction that
settles it: the perimeter is the tailnet EXISTING, which machine-setup still
arranges on a core install — not the platform shipping the screen that
administers it.

Verified by counting: live code, setup provisioning, env references, permission
entries, app-store entries, hono mounts, dock defaults, screens and panel apps all
zero. What is left is generated files (Plugins.gen, plugin-schemas.gen), the
bundled catalogue entry, test fixtures using "offscale" as an example app name,
and history.

tsgo clean, frontend builds, 873 pass / 7 fail unchanged, setup scripts parse.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/app-store/catalogue.ts

@@ -359,9 +359,10 @@ export const CATALOGUE: CatalogueEntry[] = [
       },
     ],
   },
-  // Headscale was here until 2026-08-14 and is CORE now — `officer-headscale` runs in the baseline
-  // profile, so it is not something you install, and `catalogue.test.ts` had been failing on exactly
-  // that ("does not offer to install the baseline") since it was promoted.
+  // Headscale was here until 2026-08-14. It became a core sidecar, and then on 2026-08-15 it left the
+  // repository entirely: it is the `offscale` PLUGIN now, installed from the marketplace, and neither
+  // this catalogue nor `CORE_PROCESSES` mentions it. The note below is kept because the FAILURE it
+  // describes is about this file's model and would happen again to anything promoted out of it.
   //
   // Leaving it here did more than fail a test. Availability is derived ONLY from `sidecar_installs`,
   // and a core sidecar never gets a row there — so `headscale` and `vpn` were permanently `unavailable`,

src/servers/sidecar/invoiceshelf/config.ts

@@ -14,7 +14,7 @@ import { UpstreamError, callUpstream, invalidateConfig, listCompanies, mintToken
 //
 // The Sanctum token is WRITE-ONLY across this boundary. The list reports each account's label, URL, pinned
 // company and whether it is selected; it has no field that could carry a token, masked or otherwise. The
-// only way to change one is to send a new one, which is the same shape photos and headscale use.
+// only way to change one is to send a new one, which is the same shape photos and offscale use.
 //
 // A save is validated before it is stored, and the validation does something the photos one does not: it
 // lists the companies the token can act for and PINS one. The `company` header is the sharpest edge in this

src/servers/sidecar/photos/config.ts

@@ -14,7 +14,7 @@ import { UpstreamError, callUpstream, invalidateConfig, mintApiKey, normalizeBas
 //
 // The API key is WRITE-ONLY across this boundary. The list reports each account's label, URL and whether it
 // is selected; it has no field that could carry a key, masked or otherwise. The only way to change one is to
-// send a new one, which is the same shape headscale's server registry uses.
+// send a new one, which is the same shape the offscale plugin's server registry uses.
 //
 // "A new one" has two forms: a key the owner pasted from Immich's own settings screen, or an email and
 // password the sidecar trades for one (see mintApiKey). The password is used for that exchange and never

src/servers/sidecar/slskd/config.ts

@@ -7,7 +7,7 @@ import { authHeaders, getSlskdConfig, invalidateSlskdConfig, normalizeBase } fro
 //
 // The API key is WRITE-ONLY across this boundary. The GET reports the URL and whether a key is stored; it
 // has no field that could carry the key itself, masked or otherwise. The only way to change one is to send
-// a new one, which is the same shape the photos and headscale registries use.
+// a new one, which is the same shape the photos and offscale registries use.
 //
 // ONE connection, not a registry: nobody runs two Soulseek daemons. So there is no label, no id in the
 // path and no activate route — a save is an upsert over the single row, and the UI is one form.