Delete three modules nothing outside their own tests imported

[droplister]

Stacked on #245.

Each was reachable only from its own test file — which is why the earlier dead-code sweep missed them. That pass counted any importer, and a test counts. A module whose only consumer is its own test isn't in the product.

file	lines	why it's obsolete
core/validation/qrCode.ts	391	sanitised scanned QR input; the wallet has no scanner
services/core/RequestManager.ts	338	superseded by approvalService + request storage
components/ui/cards/address-card.tsx	42	no reference of any kind

2,312 lines removed including tests.

The QR one is worth a note

qrCode.ts did XSS, protocol and path-traversal checks on scanned QR text. But components/ui/qr-code.tsx only generates QR codes onto a canvas — there is no scanner and no untrusted QR input path.

So AUDIT.md line 199 claims a control that guards an attack surface that doesn't exist: "QR code sanitization | XSS, protocol, path traversal protection" as ✅ implemented. That's the opposite of the understatement fixed in #242, and worth correcting separately.

Deliberately not deleted

core/validation/csv.ts (294) and core/validation/file.ts (382) are also unreferenced — but each is the better implementation of something a caller now does inline and less carefully:

• csv.ts has detectCSVInjection, a row cap, address validation and a real quoted-value parser. pages/compose/send/mpma/form.tsx hand-rolls a regex parser with no injection check and no row bound.
• file.ts has validateFileType, validateFileName, detectMaliciousContent. file-upload-input.tsx validates nothing ("let parent handle size checking"), and compose/broadcast/form.tsx checks size only, passing the browser-reported file.type straight through as mime_type.

Deleting these removes the good version and keeps the weak one. Wiring them up is a behaviour change on the MPMA send and inscription paths — inscriptions only started working in 0.7.0 — so it belongs in its own change with its own tests, not bundled with a deletion.

Verification

• tsc --noEmit clean; biome check src clean (672 files)
• vitest run src — 3963 passed, 49 skipped
• wxt build succeeds, bundle unchanged at 2.46 MB

[droplister]

Squashed into #249.