Decommission the InsForge cloud backend

[pitimon]

Follow-up to the local-only change (see the PR from refactor/local-only-remove-cloud). That PR makes the shipped product local-only; this issue covers retiring the backend it used to talk to.

Deliberately kept out of that PR: none of the items below ship in the npm package (files: is bin/, src/, dashboard/dist/, two scripts, LICENSE, README), so a CLI user never sees them, and deleting the source here does not undeploy anything. Sequencing depends on whether the deployed backend must keep serving users still on a cloud build.

Scope

• dashboard/edge-patches/ — 18 InsForge edge functions, including tokentracker-ingest.ts (the endpoint the removed CLI uploader POSTed to), tokentracker-leaderboard{,-refresh,-profile}.ts, the four tokentracker-device-* functions, and tokentracker-public-visibility.ts. They import npm:@insforge/sdk and read INSFORGE_SERVICE_ROLE_KEY.
• CI still injects InsForge credentials into every build: .github/workflows/ci.yml:62-63, npm-publish.yml:38-39,82-83, release-dmg.yml:97-98, release-windows.yml:75-76. Comments there describe consequences that can no longer occur — release-dmg.yml:90-93 warns that omitting them "disables cloud OAuth (isCloudInsforgeConfigured() returns false)", referencing a deleted function. Also .env.example, dashboard/.env.example, dashboard/.mcp.json.
• Native apps still ship a full OAuth flow against a server that will not answer: TokenTrackerBar/.../TokenTrackerBarApp.swift:78,80 and DashboardWindowController.swift:61,363-393; TokenTrackerWin/DashboardWindow.cs:197-201,266-281,503-516 and ServerManager.cs:159-168 (which pins a port "in InsForge's allowed-redirect-URL list").
• dashboard/vercel.json — SPA rewrite config for a deploy that no longer exists.
• dashboard/vite.config.js:1192-1200 — a working /api/auth proxy to InsForge with cookieDomainRewrite, dormant behind VITE_INSFORGE_BASE_URL. Dev-server only, does not ship, but it is the last live cloud code path in the repo.
• SECURITY.md:34 describes an insforge/ directory that is not at that path; docs/npm-publish-checklist.md:74-78 still checks for device tokens and leaderboard absence.

The actual security action

Rotating or revoking the InsForge service-role key at the source is the real remediation — editing the YAML is not. Any key that has been in CI should be treated as exposed to everything that ever ran there.

Related, already handled in the PR: an upgrading install kept a live deviceToken in config.json because init spread the old config forward, and the same release removed the status/diagnostics lines that used to reveal it. init now scrubs it and unlinks relay-cookies.json, upload.throttle.json and auto.retry.json.

Also noted, low priority

Removed endpoints such as /api/auth/refresh return 200 with the SPA shell rather than 404, because src/commands/serve.js:141 has an unconditional SPA fallback for unmatched paths. Pre-existing and no caller remains, but a stale client would read 200 as success.

[pitimon]

Status after PR #76 (fdf5b59 → merged 588e49c):

Done — the code decommission shipped. Removed dashboard/edge-patches/ (18 InsForge edge functions), the InsForge env blocks in all 4 CI workflows, vercel.json/.mcp.json, the InsForge proxies in vite.config.js, and every InsForge host/anon-key reference. git grep for srctyff5.us-east.insforge.app and ik_9f357 on main is now clean.

Not this fork's concern (removed from scope):

• Undeploy the 18 edge functions — the deployed backend belongs to upstream mm7894215 (introduced in 812185c). This fork never operated it.
• Rotate INSFORGE_SERVICE_ROLE_KEY — that key lives on upstream's InsForge project and was never in this fork's CI or repo (only the public ik_ anon key was, now removed). Nothing here to rotate.

Optional leftover (dead code, not shipped): the native-app OAuth clients TokenTrackerBar/ (Swift) and TokenTrackerWin/ (C#) still reference the old cloud auth. They are not in the npm files: list, so no CLI user sees them. Keeping this issue open only for that cleanup; otherwise it can close.

[pitimon]

Closing as done for this fork.

The repo/CI/web decommission shipped in PR #76 (588e49c): removed all 18 dashboard/edge-patches/ InsForge Edge functions, the InsForge env blocks in every workflow, vercel.json/.mcp.json, the InsForge proxies in vite.config.js, and every InsForge host/anon-key reference. A git grep for srctyff5.us-east.insforge.app / ik_9f357 on main is clean.

Not this fork's concern (removed from scope):

• Undeploy the 18 Edge functions and rotate INSFORGE_SERVICE_ROLE_KEY — the deployed backend and that key belong to upstream mm7894215 (introduced in 812185c); this fork never operated it or held the secret (CI only ever injected the public ik_ anon key, now removed).

Deliberately not in scope (dead code, not shipped): the native-app OAuth clients TokenTrackerBar/ (Swift) and TokenTrackerWin/ (C#) still reference the old cloud auth, but they are not in the npm files: list, so no CLI user sees them. If we ever want that cleanup it can be a fresh, self-contained issue — it doesn't block anything.