Inventory legacy Fresh responsibilities and close retirement gaps

[dahlia]

Problem

The legacy web/ application cannot be removed safely until every responsibility it still owns is known. Routes are only part of the inventory: authentication, uploads, static assets, well-known endpoints, federation handling, operational defaults, and deployment routing may still rely on the Fresh service.

Tasks

• Inventory user-facing routes, islands, API handlers, static assets, and middleware under web/.
• Map every responsibility to web-next, the standalone GraphQL service, another maintained component, or an explicit removal decision.
• Compare authentication, account management, composition, moderation, uploads, discovery, and federation behavior.
• Identify production traffic and reverse-proxy routes that still target port 8000.
• Record shared resources such as web/fonts that are consumed outside the legacy application.
• Add or link follow-up work for every uncovered parity gap.

Acceptance criteria

• Every legacy route and non-route responsibility has a documented destination or removal decision.
• No production-only responsibility is left without an owner.
• Required parity work is complete or tracked as a blocking issue.
• The cutover and removal issues have a concrete, reviewable checklist.

AI assistance: This issue was drafted and organized with Codex after a maintainer-led code audit.