Retire legacy routing authority

[stef-k]

Summary

• Retires the legacy administrator/global/user routing authority: global external-routing fields, generic routing-provider configurations, templates, credentials, active-provider selection, profile mappings, verification/activation paths, and UserRoutingConfiguration are removed.
• Retains personal provider authority as the sole outbound geocoding/directions authority.
• Retains explicit provider-native modes and the exact released-Mobile omitted-mode compatibility allow-list; Transport Profile labels, categories, speeds, mappings, and free-form keys do not become routing authority.
• Removes /User/RoutingSettings and /User/ApiToken; their former GET routes now return 404.
• Removes the administrator routing pages, templates, mappings, navigation, and operational editing while preserving administrator-managed Transport Profiles.
• Preserves Segment scalar route provenance and Transport Profiles. Historical RouteProviderConfigurationId/version values remain scalar data without a live legacy foreign key; new personal-provider routes do not create legacy configuration identity.
• Updates the changelog and provider, architecture, configuration, services, API, troubleshooting, and feature documentation.
• The WayfarerMobile repository is unchanged.

Database migration

20260904100416_RetireLegacyRoutingAuthority applies the dependency order required for populated databases:

1. Remove the ApplicationSettings active-provider foreign key/index and global fields.
2. Drop the UserRoutingConfigurations trigger/function and table.
3. Drop routing-provider profile mappings.
4. Drop routing-provider configurations.

Dropping the two credential-bearing legacy tables intentionally deletes their retired ciphertext; it is not copied into personal provider profiles. The migration retains Locations, imports, Trips, Places, Timeline data, personal provider profiles/admissions, Transport Profiles, Segment geometry, metrics, instructions, and scalar accepted-route provenance.

Down can recreate empty legacy structures but cannot reconstruct deleted credentials, templates, mappings, selections, or global authority. Rollback therefore requires restoring the pre-upgrade PostgreSQL backup together with the matching Data Protection key-ring backup before starting the application.

Validation

Evidence for approved exact head 04d5b2ab98e4df7dc62473429b63de83dd4b94f8:

• Focused routing-authority, acceptance-race, controller/route-retirement, migration, and PostgreSQL tests passed after the reviewed remediations.
• Full-suite validation completed with two independently classified out-of-scope test-debt failures; neither has a production counterexample and both are tracked below.
• Backend restore/build passed.
• EF migration generation/model and forward/rollback migration coverage passed with explicit ApplicationDbContext authority.
• Exact-head GitHub Actions test run 33871912870 passed, including frontend audit/typecheck, all deterministic client tests, production asset build, restore, built-asset validation, LOC limits, test build, ordinary tests, and Playwright rendering/artifact verification.
• Authenticated Playwright Chromium check passed for tests/e2e/shared-layout/routingAuthorityRetirement.spec.ts (1/1): /User/LocationProviderSettings rendered separate Geocoding and Directions sections, showed Mapbox Directions is not implemented and is not offered, omitted obsolete routing navigation, and returned 404 for /User/RoutingSettings and /User/ApiToken.
• Successful authenticated screenshot captured at .local/playwright/shared-layout-output/routing-authority-retirement/location-provider-settings.png. The established gh CLI workflow cannot upload a local image attachment, so the ignored artifact is retained locally and no source-controlled screenshot commit was added.
• Repository LOC policy check passed without a hard-cap violation.
• Code Guard has no FAIL or INCOMPLETE findings. REVIEW findings are accepted for generated EF model/snapshot callables, the cohesive linear migration rollback, existing cohesive parser branching, and focused scenario tests; splitting those solely for metrics would add indirection.
• git diff --check passed, and the final diff/status checks show no unexpected source changes.

Test-debt follow-ups

• Make legacy location lookup planner assertion deterministic #542 tracks the PostgreSQL planner-sensitive assertion in LocationImportBoundedPostgresTests.LegacyNoKeyLookup_PostgresPlansCanUseTimeAndSpatialIndexes. It requires deterministic proof of time/spatial index usability without forcing one exact valid planner choice.
• Make TileCache progressive-admission timing assertion deterministic #543 tracks the newly observed TileCache progressive-admission scheduling/timing behavior, with historical TileCache context. It requires deterministic synchronization rather than wider sleeps or timing tolerances.

Deployment notes

This PR performs no deployment or release. Before deploying the migration, take and verify the coordinated pre-upgrade PostgreSQL and Data Protection key-ring backup. Deploy the compatible backend in the documented release order; do not infer, migrate, authorize, verify, or select personal provider authority from retired data.

Closes #538