fix(api,admin-ui,user-ui,brochureware): remove dead refresh surface and legacy auth fields

[markwylde]

Summary

• remove unused user/admin refresh-token controllers and their OpenAPI references
• clear admin refresh cookies on logout to match user logout behavior
• remove legacy OPAQUE login sub request/response fields no longer used by server-side identity binding
• remove stale admin UI OPAQUE register API surface that no longer has backend routes
• align brochureware docs to use /api/token refresh grant language instead of /api/refresh-token

Commits

• fix(api,admin-ui,user-ui): remove dead refresh and legacy auth fields
• fix(brochureware): align refresh docs with token refresh grant

Validation

• npm run tidy
• npm run build
• npm test