R1 cleanup: collAnon and dead code gone, docs current, every peer's scenario in one sweep

Starts the completion program (docs/ROADMAP.md, "Owner decisions on finishing everything", 2026-10-17).

- Dead code: the commented-out collAnon blocks (discussions, seeding, admin user lists, HTTP/3, the old signature
  middleware), the empty PrivaPubWorkersConfiguration, PublicAvatarUsersService and UserPolicyType, unused helpers,
  the second IPasswordHasher registration, the PasswordGenerator package, SignUpAsync/LoginAsync's unused invitation
  parameters. "Starting PrivaPub"; a signed-in login is sent to "/", not to "/discussions".
- Stored fields nothing read: RootUser.Contacts and ResetPasswordToken*, the local Avatar.AvatarServer,
  EmailRecovery.RecoveryCode/RequestIP/CreationDate, MongoSettings.LogsDatabase, and AppConfiguration's
  upload/discussion keys, RequiresFirstTimeSetup and Version (old documents still load: MongoDB.Entities ignores extra
  elements). DmPost's indexes are no longer made. 49 collAnon keys leave FieldsNameResource in every language.
- /clientapi/data/current-version answers the build's ref. UsersIds is a list that can't throw, and the admin routes
  leave the administrator out without mutating the request.
- deploy.yml checks SecureMode on a name no persona can have, and the browser redirect on the directory's first local
  persona: @thepra is the administrator's own now.
- Town: decePub's e2e remnants (expect, client.jsonl, the decePub column) and town/tests go; the dead gaps/load
  commands too. Mobilizon no longer keeps an event for a deleted test.
- tools/pasture/sweep.sh runs every peer's scenario, batch by batch, as CLAUDE.md asks before a change to what
  PrivaPub sends.
- Docs: CLAUDE.md's repo map, route table (every frozen route) and stale lines; ROADMAP's status (setup, v1.25.0,
  v1.26.0, the program C), the 2026-10-17 decisions, and dated notes where earlier text no longer holds; FEDERATION.md's
  FEP list (7888, f228, 7628, ae0c and 8967 supported) and the deploy's persona.

Verified: dotnet build PrivaPub.sln -c Release (0 errors, no new warnings); bash -n on the touched scripts; py_compile
on the town; the pasture's gts, mastodon and lemmy scenarios on this build.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

PrivaPub/Models/User/Avatar.cs

@@ -29,7 +29,6 @@ namespace PrivaPub.Models.User
 		public string PictureURL { get; set; }//icon
 		public string ThumbnailURL { get; set; }//image
 		public AvatarType AvatarType { get; set; } = AvatarType.Person;
-		public AvatarServer AvatarServer { get; set; } = AvatarServer.PrivaPub;
 
 		public DateTime UpdatedAt { get; set; } = DateTime.UtcNow;
 		public DateTime CreatedAt { get; set; } = DateTime.UtcNow;

PrivaPub/Models/User/EmailRecovery.cs

@@ -5,10 +5,7 @@ namespace PrivaPub.Models.User
 	public class EmailRecovery : Entity
 	{
 		public string RootUserId { get; set; }
-		public string RecoveryCode { get; set; }//plaintext codes before 2026-10-04; migration _011 removed them, never written now
 		public string CodeHash { get; set; }//sha-256 of the code, hex; the code itself exists only in the email
 		public DateTime ExpiresAt { get; set; }
-		public string RequestIP { get; set; }
-		public DateTime CreationDate { get; set; } = DateTime.UtcNow;
 	}
 }

PrivaPub/Models/User/RootUser.cs

@@ -14,12 +14,8 @@ namespace PrivaPub.Models.User
 		public bool IsBanned { get; set; } = false;
 		public string HashedPassword { get; set; }
 		public List<string> Policies { get; set; } = new() { ClientModels.Policies.IsUser };
-		public List<ContactItem> Contacts { get; set; } = new();
 		public RootUserSettings Settings { get; set; } = new();
 
-		public string ResetPasswordToken { get; set; }
-		public DateTime? ResetPasswordTokenSentAt { get; set; }
-
 		public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
 		public DateTime UpdatedAt { get; set; } = DateTime.UtcNow;
 		public DateTime? DeletedAt { get; set; }
@@ -38,14 +34,6 @@ namespace PrivaPub.Models.User
 		}
 	}
 
-	public class ContactItem
-	{
-		public string Type { get; set; }
-		public string Contact { get; set; }
-		public string Note { get; set; }
-		public DateTime CreationDate { get; set; } = DateTime.UtcNow;
-	}
-
 	public class RootUserSettings
 	{
 		public string LanguageCode { get; set; } = "en-GB";

PrivaPub/Models/User/UserPolicyType.cs

@@ -1,9 +0,0 @@
-namespace PrivaPub.Models.User
-{
-	public enum UserPolicyType
-	{
-		IsUser,
-		IsModerator,
-		IsAdmin
-	}
-}