Fleet ADR/architecture completion — internal/api decomposition + no-legacy purge + enforcement

[krisarmstrong]

Tracking issue for the 2026-06-16 architecture-completion program in stem: STRICT file-size bookend, no-legacy/no-grandfathering purges (Database/Save* aliases, /auth/csrf legacy route, TierEnterprise+TierTestSuite retirement), ADR-0011 internal/api decomposition (ratelimit→sse→tls→handlers leaf strangle), and restoring CI gates dropped by #442. Best-modern-practice bar; no legacy, no grandfathering.