v0.5.5 — code quality patch (route extraction + dead code removal)

Internal hygiene patch. No behavior changes; same API, same wire format.

Tier 1 — clean-code rule violations

• Broken lint script removed — package.json declared eslint src tests but eslint wasn't in devDependencies. npm run lint always failed. Dead config.
• Three truly unused exports deleted — clearBackfillState, PredicateVocab, MarkerKind. Confirmed by exhaustive grep across src/, tests/, and scripts/.
• CSS variable migration finished — 7 legacy --text-* aliases (text-dim, text-muted, text-faint, text-ghost, text-dead, text-void, text-primary) had zero call sites and were sitting in styles.css with TODO: migrate notes since a half-done refactor. Removed.

Tier 2 — single-responsibility

createApp() in src/http/app.ts was 893 lines holding middleware setup + 41 route registrations. The author had already organized the routes into 9 ASCII-bordered sections — that's a code smell that says "these want to be separate functions."

Extracted into 15 named register*Routes functions:

Function	What it owns
installLocalOnlyMiddleware	Host + Origin + Bearer gate on /api/*
registerHealthRoute	/api/health
registerMcpRoute	Streamable-HTTP MCP at /mcp (conditional on mcpDeps)
registerRecallRoutes	/api/recall + stats/recent/cite-event/cite-stats/citation/explicit
registerHookRoutes	pre-compact + subagent-start
registerHermesAgentHookRoutes	pre-turn + post-turn + session-lifecycle
registerFactRoutes	facts + history + stats
registerLiveRoutes	recent-writes + recent-markers
registerDatasetRoute	/api/dataset
registerDataManagementRoutes	data-stats + backup + restore
registerActionRoutes	action CRUD + batch + undo + list
registerClassifierRoutes	classifier info + swap
registerSourceRoutes	sources CRUD + regenerate-token
registerIngestRoute	webhook push ingest
registerProviderRoutes	providers CRUD + models + test
registerSessionRoute	/api/session/:id

createApp body: 893 → 26 lines. It now reads as a pure composition: middleware, then a single register* call per route group, then UI mount. Route bodies themselves are byte-for-byte unchanged.

---

612/612 tests passing. Pure refactor — no API surface changes, no migration.