delete the claude-done hook and its unauthenticated endpoint

The chain was: a Stop hook in Claude's settings curls POST /api/hooks/claude-done,
the platform POSTs /_officer/panel-refresh to the pty sidecar, the sidecar sends a
`panel-refresh` frame to every attached terminal, and the Claude Code panel bumps
`preview:refresh` and `files:refresh-signal`.

It has never fired. generateClaudeSettings writes settings.json into the MANAGED
home under DATA_PATH, but HOME_DIR points terminals at the owner's real login home
— which is where Claude reads its settings from. Verified on this machine: no
claude-done hook exists in ~/.claude/settings.json, and DATA_PATH/*/home/.claude
does not exist at all.

Deleting rather than repairing it, because the Chat panel already does exactly this
job from onTurnComplete — in-process, conditioned on the turn having made tool
calls, with no hook, no HTTP round trip, and no endpoint. The chat UI is where agent
work happens; the terminal TUI is not the destination.

Also removes /api/hooks/claude-done, which was mounted above protectedRouter and so
was the one unauthenticated write-ish endpoint on the API surface.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/sidecar/pty/server.mjs

@@ -7,7 +7,7 @@ import * as store from './sessions.mjs';
 // browser and relays bytes here without reading them.
 //
 // The socket protocol is the one the browser already speaks, unchanged: {input,resize} in,
-// {output,replay,exit,panel-refresh} out. That is deliberate — the frontend did not have to move for the
+// {output,replay,exit} out. That is deliberate — the frontend did not have to move for the
 // transport to.
 
 const wsSend = (socket) => ({
@@ -37,12 +37,6 @@ export function startServer() {
       return json(res, killed ? 200 : 404, { ok: killed });
     }
 
-    // The claude-done hook: tell attached terminals to refresh their panel.
-    if (url.pathname === '/_officer/panel-refresh' && req.method === 'POST') {
-      store.broadcastPanelRefresh();
-      return json(res, 200, { ok: true });
-    }
-
     json(res, 404, { error: 'not found' });
   });