chore: remove dead canvas_eval bridge and archive 34 orphaned modules

[Harry19081]

Two dead-code removals, found while checking an external agent's claim that this repo contains "31 potential hardcoded secrets and 352 eval/exec calls." That claim did not survive verification — the secret hits are all test fixtures in key-vault (a crate whose job is detecting API keys, so it necessarily contains key-shaped strings), and the "352" lumped Rust Command::new process spawning and JS regex .exec() in with eval(). But checking it did surface two genuine pieces of dead code.

1. canvas_eval postMessage bridge

EVAL_BRIDGE_SCRIPT injected an eval() postMessage listener into every html-mode canvas iframe. Nothing in the tree ever posted a canvas_eval message — the playground's own comparison table already recorded it as postMessage (dead). The live path is A2UIRendererHandle.evalScript.

Removing it takes eval( in the TS/JS sources from 1 to 0, and buildHtmlDocument now injects no script at all. Also refreshed the CodePreview security note, which described itself as deliberately omitting a bridge that no longer exists anywhere.

2. 34 orphaned modules → .archive

A mechanical sweep, not a feature removal: 34 modules (~5,120 LOC) that no file in the repo imports.

Found by building the src/ import graph and diffing it against the file list. The graph resolves the @src/@api/@common/@page/@assets aliases, lazy import(/* webpackChunkName */ …), new Worker(new URL(…)), and source paths named as plain strings from root configs (vitest setupFiles, webpack entry). Calibrating against real false positives caught two classes on the first pass — lazy chunk imports and the projection web worker — both now handled. Every archived file additionally has a basename appearing in no other file under src/, tests/, or scripts/, so nothing reaches them by import, by test, or by name.

Nothing imported them, so severing them required no edits to live code — this is a pure git mv. That is also independent corroboration: had any of the 34 been reachable, something would have had to change.

Paths mirror their original src/ location per the .archive convention, so restoring any file is a reverse move. .archive/README.md documents the method, the file list by area, and the verification.

Why the repo's own tooling didn't catch these

• npm run check:unused-exports answers a different question. ts-unused-exports reports exports nobody imports (1047 modules) — a fully-live module that over-exports its internal types lands on that list, while a module nobody imports at all need not.
• npm run check:circular is broken: madge crashes with TypeError: Cannot read properties of undefined (reading '0') because tsconfig.json opens with a block comment before the JSON object. tsc tolerates it, madge's bundled TS parser doesn't. Not fixed here — unrelated to this change, wants its own commit.

Deliberately left alone

• 151 unused barrel files (index.ts / exports.ts). Some are intended public-API surface that internal callers reach past, so a bulk move would be wrong. Needs a per-barrel judgement call.
• new Function(js)() at A2UIRenderer.tsx:263. Currently unreachable — nothing dispatches the canvas-event that feeds it. Worth flagging because unlike the bridge removed above, it runs in the main window with Tauri IPC in scope, not inside a sandboxed iframe. If the backend WebSocket emitter its doc comment describes ever lands, it should move behind an iframe boundary first — particularly for share/replay, where content could originate remotely rather than from the local agent.

Verification

Run after the moves:

• tsc --noEmit — clean
• vitest run — 701 files / 6390 tests passed
• webpack --mode production — exit 0, compiled in 148s, no errors

The production build was the one that mattered: it's the only check that would catch a lazy-loaded chunk resolving differently under webpack than under tsc.