refactor: decommission InsForge cloud backend from repo + CI (part of #71)

[pitimon]

Part of #71. Retires the repo/CI/web-dev cloud surface that the now-local-only product used to talk to. Nothing here ships in the npm package, so deleting it undeploys nothing.

Scope per decision: web/CI/repo only. Native-app OAuth (Swift/C#, 76 files) is a separate follow-up on #71.

The actual security action is NOT in this diff

Per #71, the real remediation is rotating/revoking the InsForge service-role key on the InsForge dashboard. That key was never in this repo — edge functions read INSFORGE_SERVICE_ROLE_KEY from Deno env at deploy time; CI only ever injected the public ik_ anon key (safe by design, now removed anyway). Confirmed by a repo-wide scan: no service-role value is hardcoded anywhere.

Removed

• dashboard/edge-patches/ — all 18 InsForge Edge functions + the 3 tests that only guarded them (edge-patch-pricing-sync, badge-svg-render, and two leaderboard-refresh byte-equality cases surgically removed from model-breakdown.test.js — the live buildFleetData/pricing tests stay).
• InsForge creds from all 4 workflows (ci, npm-publish, release-dmg, release-windows) + the stale comments claiming their absence "breaks the build" or "disables cloud OAuth (isCloudInsforgeConfigured())" — that function was deleted in refactor: make TokenTracker local-only #72 and nothing reads VITE_INSFORGE_* anymore.
• dashboard/vercel.json (dead deploy config), dashboard/.mcp.json (InsForge MCP dev tooling), the /api/auth→InsForge proxy and the insforgeBaseUrl passthrough in dashboard/vite.config.js.
• InsForge / service-role / device rows from .env.example; rewrote dashboard/.env.example to the one local (mock) var.
• Stale references in SECURITY.md (insforge/ path), CLAUDE.md, the curated-overrides pricing note, the guardrails ignore list, and the leaderboard-absence item in the publish checklist.

Test plan

• dashboard:build succeeds with no VITE_INSFORGE_* env — proves the "must be present or the build fails" comments were stale. Built bundle carries no insforge/statuspage host.
• ci:local green end-to-end: dashboard 233/233, root 752 + 4, all validators pass (copy 626 entries, ui-hardcode ok, guardrails ok, openwiki 0 findings). Test-count drop vs main is exactly the removed guards for removed code.
• All 4 workflow YAMLs parse; no orphaned empty env: left behind; no secret added.
• CI (ci:local on ubuntu-latest) passes on this PR.

Still open on #71 after this

• Native-app OAuth removal (TokenTrackerBar Swift + TokenTrackerWin C#).
• The service-role key rotation on InsForge (user action — the real remediation).