chore: correct false comments, remove dead code, wire missing telemetry

[lakhansamani]

A repo-wide scan for two things: comments asserting behaviour the code does not
have, and exported identifiers nothing references. unused is already enabled in
.golangci.yml, but it only catches unexported identifiers within a package —
exported-but-unreferenced code in internal/ slips past it, which is where all of
this was hiding.

False claims corrected

Where	Claim	Reality
mcp/schema_test.go:69	documents TestSchemaForMessage_ScalarOnly	function is TestSchemaForMessage_AllScalarKinds
interceptors_test.go:147	documents TestValidate_PreservesInvariant	function is TestValidate_BuildsCleanly
memory_store/db/cache.go x3	"7 providers" / "all 7 backends"	6 — the 7th directory is provider_template, a scaffold

mcp/server.go's reference to TestServer_StdioOnly is deliberately left: it is
past tense ("the guard that enforced it"), and transport_test.go:17 documents the
replacement. Accurate history, not a stale claim.

Dead code removed

webhook_event_authorization.go — 13 constants. Worse than unused: nothing
fired them and nothing could subscribe to them. They were never added to
validators.validWebhookEventNames, so registering a webhook for
permission.created was rejected as an invalid event name. The file's own header
records this exact bug happening before with the SCIM events — same shape, second
occurrence.

GoogleUserInfoURL (already self-documented "deprecated and not used") and
MicrosoftUserInfoURL — both providers resolve via OIDC discovery now.

TokenTypeURNRefreshToken / TokenTypeURNIDToken — RFC 8693 URNs this server
does not accept (isSupportedExchangeTokenType takes access_token and jwt only).
The block now states what Authorizer accepts rather than copying the registry.

Missing telemetry wired

The constants existed; nothing emitted them. Same class of defect — a name
asserting behaviour never implemented.

• AuditPasswordChangedEvent and AuditMFADisabledEvent now fire from
  UpdateProfile, in addition to AuditProfileUpdatedEvent so nothing
  consuming that today breaks. A password change and an MFA disable were
  indistinguishable from a display-name edit — anyone auditing "who changed a
  password" had nothing to query.
• metrics.EventMagicLink and metrics.EventVerifyOTP are now recorded.
  Magic-link and OTP volume were invisible next to login/signup/oauth on the same
  dashboard. EventVerifyOTP was even asserted by a test while never emitted in
  production.

Deliberately not deleted

Nine audit-event constants remain unemitted. Each now says RESERVED and why,
instead of "is logged when X" — the "is logged when" was the false claim, not the
constant's existence.

AuditAdminUserCreatedEvent is the clearest. I first read it as a compliance gap
(update and delete are audited, create isn't) and that was wrong: there is no
admin create-user operation at all. AdminProvider exposes
Users/User/UpdateUser/DeleteUser, and creation goes through the invite flow, which
logs AuditAdminInviteSentEvent. Never a missing log call.

After this PR plus #776 and #777, every remaining zero-reference exported constant
is either explicitly RESERVED with a stated reason, or a
TokenEndpointAuthMethodClientSecretPost-style enum member used only in tests. Not
"zero unused code" — documented and accounted for, which is the honest goal.

Verification

TestProfileSecurityEventsAreAuditedSeparately confirmed failing with the source
reverted (no user.password_changed audit entry, no user.mfa_disabled audit entry).

go build ./...   OK
go vet ./...     OK
make test        exit 0 — 43 packages, 0 FAIL
make lint        exit 0