delete the claude-done hook and its unauthenticated endpoint

The chain was: a Stop hook in Claude's settings curls POST /api/hooks/claude-done,
the platform POSTs /_officer/panel-refresh to the pty sidecar, the sidecar sends a
`panel-refresh` frame to every attached terminal, and the Claude Code panel bumps
`preview:refresh` and `files:refresh-signal`.

It has never fired. generateClaudeSettings writes settings.json into the MANAGED
home under DATA_PATH, but HOME_DIR points terminals at the owner's real login home
— which is where Claude reads its settings from. Verified on this machine: no
claude-done hook exists in ~/.claude/settings.json, and DATA_PATH/*/home/.claude
does not exist at all.

Deleting rather than repairing it, because the Chat panel already does exactly this
job from onTurnComplete — in-process, conditioned on the turn having made tool
calls, with no hook, no HTTP round trip, and no endpoint. The chat UI is where agent
work happens; the terminal TUI is not the destination.

Also removes /api/hooks/claude-done, which was mounted above protectedRouter and so
was the one unauthenticated write-ish endpoint on the API surface.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/hono.ts

@@ -45,7 +45,6 @@ import { desktopRouter } from './api/desktop/rest';
 import { bugReportRouter } from './api/bug-report/bug-report';
 import { chatRouter } from './api/chat/chat';
 import { pipelineJobsRouter } from './api/tasks/pipeline-jobs-routes';
-import { broadcastPanelRefresh } from './api/terminal/websocket';
 import { CustomError } from './custom-errors';
 import { userMiddleware, bodyParser, isOriginAllowed, originScopeMiddleware } from './_middlewares';
 import { isMusicOriginExempt } from './_middlewares/origin-validation';
@@ -84,14 +83,6 @@ honoServer.route('/api/waitlist', waitlistRouter);
 // notifications WebSocket is upgraded at the serve level (server.tsx).
 honoServer.route('/api/vault', vaultRouter);
 honoServer.get('/api/integrations/google/callback', googleCallbackHandler);
-honoServer.post('/api/hooks/claude-done', async (ctx) => {
-  const body = await ctx.req.json().catch(() => null);
-  const email = (body as Record<string, unknown> | null)?.email;
-  if (typeof email === 'string' && email.includes('@')) {
-    broadcastPanelRefresh(email);
-  }
-  return ctx.json({ ok: true });
-});
 
 const protectedRouter = createRouter();
 protectedRouter.use(bodyParser());