api: remove the orphaned browser-extension backend surface from src/

[JSONbored]

Problem

Once both browser-extension client packages are deleted (previous sub-issue), a substantial backend surface in the root Cloudflare Worker becomes unreachable dead code — it exists solely to serve those two clients, and nothing else in the repo calls it. Left in place, it's live, tested, auth-scoped code with zero real callers: a maintenance and audit-surface liability, not neutral dead weight (it still executes, still ships in the Worker bundle, still needs to pass every future security/auth review with no functional justification). This issue removes it.

Full audit findings (2026-07-25), all in src/:

src/api/routes.ts (7,180 lines total at audit time)

• The dedicated comment-delimited section // ─── Extension contributor-context endpoints (#556) ─── and everything under it.
• Route handlers: POST /v1/auth/extension/session, GET /v1/extension/pull-context, GET /v1/extension/contributors/:login/issue-fit, GET /v1/extension/contributors/:login/issue-badges, GET /v1/extension/contributors/:login/pr-status.
• Imports of buildExtensionIssueFit, buildExtensionIssueBadges, buildExtensionPrStatus from ../signals/extension-contributor-context.
• Helper/type block: ExtensionContributorContext, ExtensionPullContextSection, EXTENSION_REVIEWABILITY_TONES, buildExtensionPullContextPayload, sanitizeExtensionPrivateText, isExtensionScopedSession, isExtensionContributorScopedSession, EXTENSION_PULL_CONTEXT_SCOPE, EXTENSION_CONTRIBUTOR_CONTEXT_SCOPE, buildExtensionPublicSafePacket, buildExtensionPrivateBlockers, ensureExtensionPublicSafeText.
• Every call site passing surface: "browser_extension" (confirm each is exclusively inside the code being removed before deleting the enum member in src/types.ts below — do not remove the type member if any surviving call site still sets it).

src/signals/extension-contributor-context.ts

Delete the entire file (137 lines) — redactExtensionText, buildExtensionIssueFit, buildExtensionIssueBadges, buildExtensionPrStatus, and the ExtensionIssueFit/ExtensionIssueBadge/ExtensionPrStatus types. Confirm no other file imports from it before deleting (at audit time, only src/api/routes.ts and its own test did).

src/openapi/spec.ts

Remove the three registrations: the /v1/auth/extension/session entry, the /v1/extension/pull-context entry (including its "Hard-coded by apps/loopover-extension... keep this path stable" comment — no longer applicable once that client is gone), and the path === "/v1/auth/extension/session" branch inside the auth-paths check.

src/auth/rate-limit.ts

Remove "/v1/auth/extension/session" from the SESSION_AUTHENTICATED_AUTH_PATHS set (and its preceding comment line referencing it), leaving "/v1/auth/github/token" as the remaining entry.

src/types.ts

Remove "browser_extension" from the ProductUsageSurface union type — only after confirming (per the routes.ts cleanup above) that no surviving call site anywhere in src/** still passes that literal.

Tests

• Delete test/unit/routes-extension.test.ts and test/unit/extension-contributor-context.test.ts entirely.
• Regenerate apps/loopover-ui/public/openapi.json (npm run ui:openapi) after the spec.ts edits and commit the result — it currently documents the three removed endpoints on the public /api reference page.

Requirements

• Every symbol/route/type listed above is confirmed to have zero remaining references anywhere in src/** before its containing file/block is deleted — do not leave an unused-but-present helper behind "just in case."
• npm run typecheck and the full unsharded npm run test:coverage pass after removal, with no coverage regression on any surviving line (deleting dead code should not lower codecov/patch-relevant coverage on anything still shipped).
• npm run ui:openapi:check passes against the regenerated spec (no drift between spec.ts and the committed openapi.json).

Deliverables

• All 5 route handlers, the signals module, and every listed helper/type/constant removed
• openapi.json regenerated and committed
• Both backend test files deleted
• Full local gate green with no coverage regression

Links & Resources

Parent epic; the package-deletion sub-issue (blocked-by — this cannot land until no client code references these endpoints). src/api/routes.ts, src/signals/extension-contributor-context.ts, src/openapi/spec.ts, src/auth/rate-limit.ts, src/types.ts.

Boundaries

Backend only — apps/** and root config/CI are already clean by the time this lands (both prior sub-issues). Do not remove ProductUsageSurface's other members or any other auth-scope constant unrelated to the extension surface.

maintainer-only — auth-scope and public API-surface authority.

[linear-code]

JSO-5956