refactor(platform): retire the convex tree, vocabulary, and packages

[larryro]

Finishes the 0.5 teardown's last pending ledger row: services/platform/convex/ no longer exists, and convex/@convex-dev/*/convex-helpers are out of the manifests. Four commits, in the order the inc-137 pause note prescribed.

What changed

1. refactor(platform): retire the convex/values validator vocabulary — the 32 modules still importing v/Infer/GenericId now declare their contracts as plain TypeScript. Zero-importer files (sandbox/wire.ts, chat/schema.ts, enterprise_sso/validators.ts) and validator-only shells are deleted or renamed to types.ts; GenericId unbrands to string (nine String() casts fell out as dead conversions); the cast-to-any helpers (type_cast_helpers, validators/json, lib/shared/schemas/utils/json-value) are gone with their call sites inlined. The CommentEventComment build guard the 0.4 comments promised is real again — the backend's comment.created emit now types its reconstruction.

2. refactor(platform): move the ported domain logic to backend/core — the whole tree moves (git mv, history preserved) to backend/core/, beside domains/: it is the ported logic the doors and jobs drive. Three genuinely shared server utilities relocate into lib/ instead (lib/net/safe-fetch.ts, lib/net/host-policy.ts, lib/chat/untrusted-content.ts), so lib/ imports nothing from backend/. A resolver-backed rewriter recomputed every relative and @/ import (369 files); non-import paths (a vi.doMock specifier, a path.resolve hop count, the shared i18n suite's scan roots) were caught by the suites and fixed. Build and config follow: Dockerfile (core is copied before the vite build — the app imports @/backend/core/* type/constant vocabulary; the runtime /app/convex copy and dead CONVEX_URL/INSTANCE_NAME envs are gone), oxlint override globs, vitest excludes, the e2e cache key, the CLI's embedded reference tree (convex → backend/core), and the last convex-named modules (ctx-shim, product-enums, use-file-upload, WebDAV's ctx.backend/backendApiUrl).

3. refactor(platform): drop the convex packages and dead client remnants — convex and @convex-dev/better-auth leave package.json, the root convex-helpers/@convex-dev/agent patches go, convex.json is deleted, and the convex commitlint scope retires. The function-refs proof suite keeps the expected name strings and drops the package comparison, as designed in inc 137. Dead client remnants go with them: the convexClient() auth plugin (its server half died with the runtime — warmConvexToken had been fetching a 404 since cutover), the convex-token-cache/use-auth-from-better-auth bridge modules and their four stale call sites, 16 inert vi.mock('@/convex/…') scaffolds, the orphaned convexDashboard locale keys (en/de/fr), and the .convex.cloud allowlist branch in the email preview (strictly narrowing).

4. docs(platform): record the convex teardown in the ledgers — MIGRATION.md's pending row flips to done; the platform and backend READMEs and .agents/repo.md describe the tree that actually exists.

Deliberately kept

The convex-data compose volume name (deployed contract — renaming would orphan operator data; the volume comment says so), SANDBOX_STORAGE_INTERNAL_BASE_URL=http://convex:3210 and the SANDBOX_CONVEX_*_DEFAULT constants (live sandbox-net alias values), the cleanup-pr-images GC list, the .convex/ gitignore entries, ParsedBlobRef's 'convex' arm and convexStorageId (stored-data format vocabulary), and historical prose in the ledger and code comments.

Not in this PR (priced, tracked)

The WebDAV HMAC helper duplication in lib/webdav/auth.ts ↔ backend/core/webdav/helpers.ts can now be folded into one copy (the isolate that forced it is gone; the parity test pins both until then), and the docs trees still carry Convex-era prose (data-residency, appDb copy) — the docs sweep inc 145 already booked.

Verification

• tsc 0 · oxlint 0 (root turbo 17/17) · format clean · SAST 0
• server+pii 72268/72268 · UI 3453/3453 · CLI 322 · packages/ui 1173
• integration 276/276 (real Postgres + MinIO; same count as fix(platform): automation equipment, wizard model pin, and drive chain #3118 — no checks lost), S3 lanes exercised, no skips
• each batch commit type-checks and lints on its own (packages still installed through batch 2; the lockfile flips with batch 3)