refactor(api): remove nine uncalled routes and the orphan observability store (#3434)

[vybe]

Fixes #3434. One of five independent stale-code PRs off dev. Draft. Squash-merge only — see Before merge.

What

• Nine API routes removed, none with a caller in the frontend, the enterprise submodule, the MCP server, the scheduler, the agent image, the CLI, scripts, CI workflows or any compose/Dockerfile health check:
  • Internal router (gated by the internal-secret dependency): GET /api/internal/health, POST /api/internal/activities/track, POST /api/internal/activities/{id}/complete, POST /api/internal/agent-files/share, GET /api/internal/agents/{name}/sync-health-status.
  • Duplicates of the live GET /api/activities/timeline: GET /api/agents/{name}/activities, GET /api/agents/activities/timeline.
  • GET /api/observability/metrics and GET /api/observability/status — routers/observability.py is deleted. GET /api/ops/costs serves a superset of the same data from the same parser; the two parse helpers moved into services/ops_costs_service.py byte-identical, with a unit test, which also removes a service→router import and a duplicated set of OTEL constants.
• The three request models only those routes used are deleted; the route census and the human-only baseline shrink to match (359 → 355 entries, shrink only).
• Frontend: stores/observability.js deleted (no component or view used it); utils/contrast.js moved to tests/unit/helpers/ (only its own spec imported it); two specs trimmed.
• Tests: new tests/unit/test_3434_removed_routes.py pins the nine routes absent from the census and the runtime route table. tests/test_internal.py, tests/test_observability.py and test_ent706_internal_sync_health.py are deleted with the routes they exercised. test_1808 is re-pinned to the threshold constant in sync_freeze_policy.py.
• Docs: api-endpoints.md, the architecture and feature-flow docs, and the user docs that named the observability routes now point at /api/ops/costs. Five places that described the internal router as "(no auth)" are corrected: it is gated by the router-level verify_internal_secret dependency.

Rulings carried (operator, recorded on the issue 2026-10-09)

• The observability router is removed, not kept as an API-only surface; docs repointed in this PR.
• The dead request models go here rather than in the dead-symbols PR.
• The integration tests that called GET /api/agents/{name}/activities are rewritten against GET /api/activities/timeline with client-side agent_name filtering.
• Correction to the original issue text: the internal router was never unauthenticated. The gain here is a smaller secret-gated surface, not a closed hole.

Review + security

/review (reading review, report-only): MERGEABLE AFTER FIXES — the one required fix (the "(no auth)" wording) is in 673101ab. Independent re-proof of no caller for all nine routes, including string-built URL forms; the observability removal is behaviour-preserving; the census, baseline and OWN_AUTH table agree mechanically with the removed routes; the new guard test is proven red against dev's tree. /cso --diff: no findings; net −9 routes, no gate on a surviving route changes.

Tests

• Backend: 10 targeted unit files, shuffled (seed 12345), one per process — all green (204 tests). test_2996_owner_config_person_only timed out locally at 240 s with no failure and is left to CI.
• Frontend: npm run test:unit 304 files / 5,141 tests passed; npm run build succeeds.
• Backend imports with 665 routes (OSS-only build); compileall clean.
• git merge-tree against dev (21b4a11): clean.
• Not run here: the full unit island (CI), and the four rewritten integration files — tests/test_activities.py (27), tests/test_parallel_task.py (25), tests/test_access_control.py (41), tests/journeys/ via conftest.py (19) — which compile and collect but need a live backend.

Before merge

• Squash merge. The first commit on this branch (245bb29c) contains only six file deletions and does not build on its own; the next commit completes it. No CI job builds per-commit, and a squash keeps the intermediate state off dev.
• Run the rewritten integration tests (verify-local or the nightly integration run). They are correct against the timeline route's real parameters and response shape, but they read a 500-row fleet-wide window with no time bound, so they can miss rows on a busy stack.
• Release notes: two documented routes (/api/observability/metrics, /status) are removed. The repo has no unreleased-notes file, so the line has to be added when the 1.0.0 notes are cut.
• Conflicts this branch adds with open PRs (merge-order calls): fix(auth): an agent key reaches only itself, its edges and the agents it spawned — on the raw backend routes too (trinity-enterprise#629) #3346 (docs/memory/architecture.md, src/backend/routers/agents.py), docs(testing): rewrite the UI test phases for the v1 UI #3437 (docs/testing/phases/PHASE_14_OPENTELEMETRY.md), fix(public-chat): an anonymous session finds its own history after a reload (#3443) #3477 and fix(settings): the email whitelist validates what it stores and can remove whatever it holds (#3455, #3456) #3479 (tests/registry.json), and refactor: remove 50 backend and scheduler symbols no production code references (#3433) #3472 from this same set (docs/memory/feature-flows/execution-queue.md). No conflict with refactor(scheduler): remove the process-schedule remnant (#3432) #3440.

Handoffs

• get_freeze_schedules_if_sync_failing (facade + implementation) has no caller once the sync-health-status route is gone; tests/test_execution_termination.py calls a route that does not exist. Both noted on refactor: remove about 50 backend and scheduler symbols that no production code references #3433.
• PHASE_14_OPENTELEMETRY.md still describes a Dashboard panel removed earlier; the decrypt-and-inject rows in api-endpoints.md and credential-injection.md describe a route no longer in internal.py (only their auth wording was corrected here).

🤖 Generated with Claude Code

[github-actions]

⚠️ Nightly unit-suite check skipped — merge conflict against dev.

Resolve by running git merge dev locally and pushing the result. The next nightly run will re-test once the conflict is gone.

[github-actions]

⚠️ Live-instance suite skipped — merge conflict against dev.

Resolve by merging dev locally and pushing the result; the next nightly re-tests.

[trinity-ability]

Reviewed: no live caller of the nine removed routes or the observability store on dev (incl. #3472/#3484 as landed), the frontend, MCP or enterprise; access unchanged (old metrics route was admin-only, /api/ops/costs is admin or ops). Route census shrinks by exactly the removed routes. Frontend 5,586 tests, guard + scheduler suites pass on the merged tree; CI fully green.