chore: remove dead UI, unused deps, and duplicate code

[skrishnan22]

Summary

Over-engineering cleanup pass. Deletion-only in spirit: zero behavior change, zero coverage lost.

• Delete 23 unused React components — the previous session UI (conversation panel, status strip, inspector stack, activity feed, plan message, split pane, task header/meta, etc.) already replaced by Timeline/ActivityTab, plus 6 unused shadcn primitives (dropdown-menu, scroll-area, resizable, collapsible, badge, separator)
• Delete the 1.6 MB prototype Codevil (standalone).html (unreferenced)
• Strip ~1,011 lines of dead CSS from session-components.css — every class verified against live source before cutting (lookalikes like timeline-msg-*, activity-turn-*, home-* kept)
• Drop 4 unused dependencies: shiki, react-resizable-panels, lucide-react (dialog close X inlined as SVG), @tanstack/react-router-devtools
• Deduplicate tests: ported the 16 unique cases from web/src/lib/__tests__/event-mapper.test.ts into shared/test/projections.test.mjs (node:test), then deleted the duplicate
• Remove dead code: unused ConfigSchema/ConfigDefaultsSchema (CLI hand-validates; Config type + DEFAULT_CONFIG kept) and the runtime-unused DEFERRED_PROVIDER_IDS export (deferred-provider rejection stays tested)
• Consolidate ws-token.ts onto capability-token.ts — removes a second hand-rolled HMAC/base64url token implementation (worker-internal token format; tests are round-trip based)

Verification

• pnpm verify on this branch: exit 0 — 903 tests, 0 failures across shared / cli / admin-cli / web / worker
• Web production build passes; CSS brace balance checked

Net

37 files, +430 / −5,286. No new abstractions; the tree gets smaller.

Skipped deliberately (needs separate decisions): observability/wide-event layer, validation-drop sink, legacyDirectoryGuardColumns (requires a D1 migration to drop NOT NULL columns), zod v3/v4 unification.

[greptile-apps]

Greptile Summary

This PR removes obsolete UI code, styles, dependencies, duplicate tests, and unused shared exports while consolidating WebSocket authorization tokens onto the existing capability-token implementation.

• Deletes superseded React components, shadcn primitives, prototype HTML, and associated CSS.
• Moves unique event-projection tests into the shared package.
• Removes unused configuration/provider exports and web dependencies.
• Reuses capability-token signing and verification for WebSocket authentication.

Confidence Score: 5/5

The PR appears safe to merge with no concrete changed-code defects identified.

The retained code has no unresolved imports or live references to the deleted UI and dependencies, the moved tests preserve the unique projection cases, and the WebSocket token consolidation retains the required authentication checks.

Important Files Changed

Filename	Overview
packages/worker/src/ws-token.ts	Replaces the bespoke WebSocket token format with audience-scoped capability tokens while retaining session, identity, role, signature, and expiry validation.
packages/shared/src/config.ts	Removes unused runtime schemas and parsed aliases while preserving the configuration interfaces and defaults.
packages/shared/src/providers.ts	Removes an unused deferred-provider constant and type without changing the supported-provider registry.
packages/shared/test/projections.test.mjs	Adds the unique event-projection coverage formerly located in the web package.
packages/web/src/components/ui/dialog.tsx	Replaces the removed lucide close icon with an equivalent inline SVG.
packages/web/src/session-components.css	Removes styles associated with deleted UI while retaining selectors referenced by the live session interface.
packages/web/package.json	Removes web dependencies for which no retained source imports remain.

_{Reviews (1): Last reviewed commit: "chore: remove dead UI, unused deps, and ..." | Re-trigger Greptile}