delete api routes with no consumers

from a full audit of all 179 route definitions under src/servers/api, tracing
consumers through useClient, raw fetch, EventSource, the capabilities repo and
the mobile monorepo. only routes with zero consumers anywhere are removed.

  server-settings/applications.ts   whole file — an app install/update registry
                                    with no settings section to drive it
  server-settings/claude-code.ts    whole file — the ai settings screen talks
                                    to chat-providers/* exclusively
  GET  browser/extension-download   superseded by a static asset; BrowserRelay
                                    links at /browser-relay-extension.zip
  GET  integrations/                a stub returning []
  GET  chat-providers/auth          /api-keys says the same thing with more detail
  GET  desktop/vnc-status           and with it the vnc:status command and reply,
                                    which existed only to serve this route.
                                    docs/sidecar-audit-2026-07.md called this
                                    one dead months ago

deliberately KEPT, because "no caller" turned out not to mean "dead":

  POST activity/announce      not orphaned — it is the missing PRODUCER for the
                              detached[] list GET activity/tasks already returns
                              and ActivityScreen already renders. an unbuilt
                              feature, not dead code, and finishing or dropping
                              it is a product decision.
  GET  agents/runs            three days old. part of agent grounds, still being
                              built. "not yet consumed" is not "dead".
  PUT/GET vault/unlock-key    six days old, storage half of a feature whose
                              client half is unwritten. the vault is off limits.
  DELETE integrations/google/connection   caller exists but is deliberately
                              commented out of the tree. dormant on purpose.

vnc-manager's getSession is now orphaned too, but it is sidecar-internal and
was not in scope; noted rather than chased.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/sidecar/protocol.ts

@@ -24,8 +24,7 @@ export type SidecarCommand =
   | { type: 'vnc:start'; id: string; params: VncStartParams }
   // Provision the VNC password without starting a server — the UI needs it before it can connect
   | { type: 'vnc:ensure-password'; id: string; email: string }
-  | { type: 'vnc:stop'; id: string; email: string }
-  | { type: 'vnc:status'; id: string; email: string };
+  | { type: 'vnc:stop'; id: string; email: string };
 
 // ── Responses/Events (sidecar → API server) ──
 
@@ -48,7 +47,6 @@ export type SidecarEvent =
   | { type: 'vnc:started'; id: string; port: number; display: number }
   | { type: 'vnc:password'; id: string; password: string }
   | { type: 'vnc:stopped'; id: string }
-  | { type: 'vnc:status'; id: string; session: VncSessionInfo | null }
   | { type: 'vnc:error'; id: string; error: string }
   // Email — new mail no longer crosses this socket; the sidecar owns the SSE stream and pushes directly
   // OpenCode — the sidecar reports where its `opencode serve` is listening (random port) on connect