[P3.1] Delete the dead v1 backend layers

[frankbria]

Filed by the SaaS launch review. Priority P3.1 — severity low, category dead-code.

Problem

Roughly 2,000 lines of v1-era server code ship in the installed wheel and the public import surface: ~870 lines of ui/models.py request/response shapes for endpoints that no longer exist (kept alive only by tests of themselves), response_models.py prescribing an envelope no endpoint uses, ConnectionManager/WebSocketSubscriptionManager whose only consumer is the test-gated /test/broadcast route broadcasting into an always-empty list, a streaming_v2 router with zero route decorators still mounted, core/config.py's 'v1 Legacy Configuration' sprint block, accounts/sessions/verification tables no query touches, unused rate_limit_auth/rate_limit_websocket decorators, a declared python-jose dependency never imported (CVE surface for free), and app.state.default_workspace_path read but never set. Dead auth-adjacent code is worse than absent code because it implies controls that are not in force.

Evidence

• codeframe/ui/models.py:21
• codeframe/ui/response_models.py:5
• codeframe/ui/shared.py:110
• codeframe/ui/routers/streaming_v2.py:119
• codeframe/core/config.py:495
• codeframe/platform_store/schema_manager.py:78
• pyproject.toml:58

Acceptance criteria

• ui/models.py and response_models.py retain only symbols a live v2 router imports; tests of removed models are deleted
• ConnectionManager/WebSocketSubscriptionManager and /test/broadcast are removed together with the skipped suite (CLAUDE.md's CODEFRAME_ENABLE_TEST_ENDPOINTS note updated), or a live consumer exists
• streaming_v2 is deleted and unmounted; the v1 config block removed and no longer re-exported; accounts/sessions/verification tables dropped from schema init
• python-jose removed; unused rate-limit decorators removed or applied; no read of an unset default_workspace_path
• uv run pytest tests/ --ignore=tests/e2e -m "not lifecycle" and cd web-ui && npm test pass

Dependencies

• blocked by [P1.19] Emit audit events for auth, authorization and API-key lifecycle, or delete the taxonomy #937 (P1.19)
• blocked by [P2.3] Route all platform_store writes through the shared lock and add schema versioning #953 (P2.3)

---

Atomic by construction: one developer, one focused session.