chore(GAT-9016): remove the legacy Express service

[calmacx]

DRAFT — do not merge. This deletes the code that is currently serving production. It may only merge after the dev cutover, the production promotion, and the agreed production soak have all completed. Opened now so the work is ready, not because it is ready to land.

What

Deletes the legacy Express service — src/ (34 tracked files) and the orphaned root swagger.json — plus the eslint.config.js ignore entry that existed only to keep the retained tree out of lint. No behavioural change.

Why

src/ was kept deliberately as the rollback artefact for the production cutover. Once production has soaked on the React Router build, the tree is dead weight: it pollutes git grep, dependency audits and onboarding. swagger.json is the legacy OpenAPI document, superseded by the swagger-jsdoc spec served at /openapi.json.

Testing

Verified on a production build, not dev mode: npm run typecheck, npm run lint and npm run build all exit 0, build/openapi.json still carries 10 paths, and the suite is 62 passed across 10 files — identical to the run before the deletion, which is the bar the plan set rather than merely "green".

Proven unreferenced before deleting. git grep "src/" outside the tree itself returned four hits, every one prose or config and none a code path: the eslint ignore (removed here), a comment in env.example citing src/app.js for the MAX_BODY_MB value (reworded), and two notes in the regression fixtures recording when the Express baseline retires (renumbered PR12 → PR09). swagger.json had zero references anywhere in the repo. No workflow mentions src/ or jest, and jest is no longer a dependency.

Notes

• Base is feat/GAT-9016-server-shell, the top of the migration stack, not dev. dev still runs Express today, so basing it there would show a deletion of the live service against a tree that has no replacement. Retarget to dev once the stack has landed.
• tests/data/*.json are kept. Git reports them as R100/R096/R093 renames of src/utils/data/*, but they are live inputs to the Vitest suites — the originals were duplicates, not the same files.
• Rollback after this merges is git checkout <this PR's parent sha> -- src, still trivial but no longer a one-command image swap on an existing tag.
• Two things deliberately left out, both worth a decision before this leaves draft: src/utils/swarmer.py is a Python load-generation helper that was never part of the service and no one would notice vanishing until they needed it; and the regression pins (tests/regression/pins.json) are marked to retire when src/ goes, but retiring them is a separate call about what CI compares against, not part of a pure deletion.

🤖 Generated with Claude Code

[gh-actions-pipelines-app]

🎉 Great job! Your PR title follows the correct format. 🚀