D11 · Final cleanup: delete legacy ThreadLocals, McpToolSet, PostgresTaskSystem remnants and the UI's database connection

Four apps/web/lib/sql files remain after #58. Each needs an owner before the UI's database connection can be removed:

Plan (branch par-424-cleanup off rebuild):

1. New apikeys domain (facade, use cases, JdbcClient repo, REST controller for POST/DELETE /keys, new GET /keys listing so the web stops reading api_key). Keys stay SHA-256 hashed. settings.manage + members-only. A platform port (ApiKeyAuthenticator) serves the bearer filters and MCP extractor so platform does not import a domain.
2. releases becomes a small read-only domain (ReleasesFacade, REST GETs + 410s, McpToolProvider). Release tables untouched.
3. Delete McpToolSet, McpResolver, TenantContext, ActorContext, KeyContext, PermissionService, TaskSystem, PostgresTaskSystem, ProjectContextStore, ActorArgumentResolver. LLM/embedding usage gets the workspace passed explicitly. Embedding worker/search move into issues (persistence + job). Rename "mirror" naming.
4. Unfreeze ArchUnit rules that reach zero; record what stays.
5. Web: delete lib/db.ts, lib/sql/**, kysely/pg; settings and API keys read through the API. discord_delivery: NOT dropping in this PR (pre-rebuild code on main still writes it; see PR).

PR open: https://github.com/ParadauxIO/taskl.ie/pull/70 (ArchUnit store emptied and deleted, rules plain; R6 hard error, no suppressions; UI DB removed; gitops request for dropping DB_* from tasklie-ui is listed in the PR; discord_delivery left in place, reason in the PR).

Merged into rebuild as #70. This closes the architecture epic's backend work.

What changed

• Deleted:
  • TenantContext, ActorContext, KeyContext, PermissionService, TaskSystem, PostgresTaskSystem, McpToolSet, McpResolver and the MCP ThreadLocal rebinding.
  • The UI's database connection (lib/db.ts, lib/sql/**, Kysely, pg).
• New domains: apikeys (hashed keys, settings.manage) and a read-only releases domain (data kept).
• ArchUnit store: empty. Every rule is strict, with no freezing.
• ESLint: R6 (the UI never touches the database, OpenAI or Discord) is a hard error with no suppressions. Ten design-rule suppressions remain.
• OpenAPI: the spec was regenerated against Postgres, which also corrects the hand-edited spec from #69.

Open decisions for Rían

1. gitops: remove the DB_* env vars, the DB secret and the network allowance from tasklie-ui once the rebuild is deployed.
2. discord_delivery: dropping it is deferred to a follow-up migration after the rebuild is live, so old pods and a rollback still work.

Dev now runs the rebuild.

• Credentials removed: I deleted DB_HOST, DB_PORT, DB_NAME, DB_USER, DB_PASSWORD and DB_SSL from development/tasklie-ui-secrets. These were out of band and are not in gitops.
• Verified: I restarted tasklie-ui in dev and it serves normally. The login page returns 200, and the logs show no database errors.
• Still to do at cutover: remove the same keys from production tasklie-ui-secrets. Also update the stale comment in gitops apps/tasklie-ui/base/resources.yaml that still says it "reads the tasklie Postgres".