Drop the calendar's legacy authentication path

Step 5, the last one, of docs/calendar-auth-migration.md. Step 4 is deployed
and verified, which is what this was waiting on: it removes the fallbacks that
step 4 still leaned on.

Gone: src/models/calendar/users/ entirely - registration, login, activation,
both password-reset routes, and the session checking that the feedback and
tickets admin areas used to authenticate against - along with its mount. That
was the API's last unauthenticated account-creation and mail-sending endpoint.
A survey confirmed nothing outside that directory imported it and nothing else
touched its tables.

Also gone: the two joins against the calendar users table in events.service.ts
and the created_by_id / version_created_by_id columns they read, from the SQL,
the row mapper, the Event interface and the swagger schema; and X-Session-Id /
X-Session-Key from the CORS allowedHeaders, which nothing has read since the
first cutover and nothing has sent since the second.

An event's author still renders, because migration 002 snapshotted the names
before this could erase them. That was brought forward from this step on
purpose, and it is the reason 004 can rename the accounts aside at all.

The accounts are renamed rather than dropped - they still hold e-mail addresses
and password hashes, and a rename makes them unreachable without destroying
anything. InnoDB rewires the sessions foreign key to the new name; verified on
MariaDB 11, along with the whole 001-004 chain from the pre-cutover production
schema, which lands byte-identical to a fresh dev database.

Migration 004 must be applied AFTER deploying, not before - the reverse of step
4, whose migration only added things. Its own header and the runbook both say
so, since getting it wrong by analogy is the obvious mistake.

DEFERRED_SECURITY.md items 3 and 4 close with it: the activation and reset
tokens that never expired are gone along with the code that issued them.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

test/admin/auth-binding.ts

@@ -7,9 +7,14 @@ import express, {Request, Response} from 'express';
  * the calendar users table; both are now one binding to the shared admin gate.
  *
  * What is worth asserting is not how that gate works - admin.middleware.test.ts
- * owns that - but that each module is bound to *its own* app, and that neither
- * consults the calendar users service any more. The mocks live in the calling
- * file because vi.mock is per-module-graph; only the assertions are shared.
+ * owns that - but that each module is bound to *its own* app. The mocks live in
+ * the calling file because vi.mock is per-module-graph; only the assertions are
+ * shared.
+ *
+ * There used to be a tripwire here asserting neither module fell back to the
+ * calendar's header sessions. It went with step 5: the calendar users service
+ * no longer exists, so there is nothing left to fall back to and nothing to
+ * assert against.
  */
 
 export interface BindingMocks {
@@ -17,8 +22,6 @@ export interface BindingMocks {
 	getSession: Mock;
 	/** loadAccess from the mocked users.admin.service.js */
 	loadAccess: Mock;
-	/** checkSession from the mocked calendar users.service.js */
-	checkSession: Mock;
 }
 
 const makeReq = (): Request => ({headers: {cookie: 'nachklang.session_token=abc'}} as unknown as Request);
@@ -60,7 +63,6 @@ export const describeAdminBinding = (
 			m = mocks();
 			m.getSession.mockReset();
 			m.loadAccess.mockReset();
-			m.checkSession.mockReset();
 		});
 
 		it('responds 401 and does not call next() without a session', async () => {
@@ -101,18 +103,5 @@ export const describeAdminBinding = (
 			expect(next).toHaveBeenCalled();
 			expect(res.locals.admin).toMatchObject({id: 'u1', email: 'a@nachklang.art', displayName: 'Anna Admin'});
 		});
-
-		// Weaker than it looks and kept deliberately: neither module imports
-		// checkSession any more, so this cannot fail today. It is a tripwire for
-		// the change that would matter - someone reintroducing a header-session
-		// fallback "just for the calendar users who have not been invited yet",
-		// which is exactly the shortcut the cutover exists to close.
-		it('never falls back to a calendar header session', async () => {
-			m.getSession.mockResolvedValue(null);
-
-			await run();
-
-			expect(m.checkSession).not.toHaveBeenCalled();
-		});
 	});
 };