delete api routes with no consumers

from a full audit of all 179 route definitions under src/servers/api, tracing
consumers through useClient, raw fetch, EventSource, the capabilities repo and
the mobile monorepo. only routes with zero consumers anywhere are removed.

  server-settings/applications.ts   whole file — an app install/update registry
                                    with no settings section to drive it
  server-settings/claude-code.ts    whole file — the ai settings screen talks
                                    to chat-providers/* exclusively
  GET  browser/extension-download   superseded by a static asset; BrowserRelay
                                    links at /browser-relay-extension.zip
  GET  integrations/                a stub returning []
  GET  chat-providers/auth          /api-keys says the same thing with more detail
  GET  desktop/vnc-status           and with it the vnc:status command and reply,
                                    which existed only to serve this route.
                                    docs/sidecar-audit-2026-07.md called this
                                    one dead months ago

deliberately KEPT, because "no caller" turned out not to mean "dead":

  POST activity/announce      not orphaned — it is the missing PRODUCER for the
                              detached[] list GET activity/tasks already returns
                              and ActivityScreen already renders. an unbuilt
                              feature, not dead code, and finishing or dropping
                              it is a product decision.
  GET  agents/runs            three days old. part of agent grounds, still being
                              built. "not yet consumed" is not "dead".
  PUT/GET vault/unlock-key    six days old, storage half of a feature whose
                              client half is unwritten. the vault is off limits.
  DELETE integrations/google/connection   caller exists but is deliberately
                              commented out of the tree. dormant on purpose.

vnc-manager's getSession is now orphaned too, but it is sidecar-internal and
was not in scope; noted rather than chased.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/api/browser/router.ts

@@ -1,5 +1,4 @@
 import { randomUUID } from 'node:crypto';
-import { join } from 'node:path';
 import { createRouter } from '@@/create-router';
 import * as errors from '@@/custom-errors';
 import { getUserIntegration, upsertUserIntegration, deleteUserIntegration } from 'officerdb';
@@ -9,8 +8,6 @@ import { captureScreenshot, evaluateJS, navigateTo } from './cdp';
 
 export const browserRouter = createRouter();
 
-const EXTENSION_DIR = join(import.meta.dir, '../../../extensions/browser-relay');
-
 async function getOpts(userId: number) {
   const port = getRelayPort();
   const integration = await getUserIntegration(userId, 'browser-relay');
@@ -22,22 +19,8 @@ async function getOpts(userId: number) {
   return { relayPort: port, userToken: token };
 }
 
-browserRouter.get('/extension-download', async (ctx) => {
-  const proc = Bun.spawn(['zip', '-r', '-', '.'], {
-    cwd: EXTENSION_DIR,
-    stdout: 'pipe',
-    stderr: 'pipe',
-  });
-  const blob = await new Response(proc.stdout).blob();
-  await proc.exited;
-  if (proc.exitCode !== 0) throw errors.INTERNAL_SERVER_ERROR('Failed to create zip');
-  return new Response(blob, {
-    headers: {
-      'Content-Type': 'application/zip',
-      'Content-Disposition': 'attachment; filename="officer-browser-relay.zip"',
-    },
-  });
-});
+// GET /extension-download used to zip the extension directory on the fly, shelling out to `zip`. It had
+// no caller: BrowserRelay.tsx links straight at /browser-relay-extension.zip, a real file in public/.
 
 browserRouter.get('/status', async (ctx) => {
   const user = ctx.get('user');
@@ -51,7 +34,11 @@ browserRouter.get('/relay-token', async (ctx) => {
   let integration = await getUserIntegration(user.id, 'browser-relay');
   if (!integration) {
     const salt = randomUUID();
-    integration = await upsertUserIntegration({ userId: user.id, provider: 'browser-relay', config: { tokenSalt: salt } });
+    integration = await upsertUserIntegration({
+      userId: user.id,
+      provider: 'browser-relay',
+      config: { tokenSalt: salt },
+    });
   }
   const salt = (integration.config as { tokenSalt: string }).tokenSalt;
   const token = registerUserToken(user.id, port, salt);