Reverts:
- f55b965 Pre-split scrub (moved to apex-private)
- d2fc194 F-13 CERT_OPTIONAL + bearer token bypass (dev-only,
  security-sensitive — do not ship publicly)
- 23beaf3 Expose Playwright cert env to child tools (Dana-local
  Playwright MCP Docker setup)
- d22149c Expose Playwright cert env (duplicate of 23beaf3)

Rationale: these commits were Dana-specific development shortcuts
that leaked into public main during rapid iteration. The bearer-
token bypass and CERT_OPTIONAL mode are not safe defaults for OSS
users. Moved to private repo (apex-private) where they belong.

See docs/wip/APEX_REPO_SPLIT_AND_BRANCHING_PLAN.md