R1 cleanup: collAnon and dead code gone, docs current, every peer's scenario in one sweep

Starts the completion program (docs/ROADMAP.md, "Owner decisions on finishing everything", 2026-10-17).

- Dead code: the commented-out collAnon blocks (discussions, seeding, admin user lists, HTTP/3, the old signature
  middleware), the empty PrivaPubWorkersConfiguration, PublicAvatarUsersService and UserPolicyType, unused helpers,
  the second IPasswordHasher registration, the PasswordGenerator package, SignUpAsync/LoginAsync's unused invitation
  parameters. "Starting PrivaPub"; a signed-in login is sent to "/", not to "/discussions".
- Stored fields nothing read: RootUser.Contacts and ResetPasswordToken*, the local Avatar.AvatarServer,
  EmailRecovery.RecoveryCode/RequestIP/CreationDate, MongoSettings.LogsDatabase, and AppConfiguration's
  upload/discussion keys, RequiresFirstTimeSetup and Version (old documents still load: MongoDB.Entities ignores extra
  elements). DmPost's indexes are no longer made. 49 collAnon keys leave FieldsNameResource in every language.
- /clientapi/data/current-version answers the build's ref. UsersIds is a list that can't throw, and the admin routes
  leave the administrator out without mutating the request.
- deploy.yml checks SecureMode on a name no persona can have, and the browser redirect on the directory's first local
  persona: @thepra is the administrator's own now.
- Town: decePub's e2e remnants (expect, client.jsonl, the decePub column) and town/tests go; the dead gaps/load
  commands too. Mobilizon no longer keeps an event for a deleted test.
- tools/pasture/sweep.sh runs every peer's scenario, batch by batch, as CLAUDE.md asks before a change to what
  PrivaPub sends.
- Docs: CLAUDE.md's repo map, route table (every frozen route) and stale lines; ROADMAP's status (setup, v1.25.0,
  v1.26.0, the program C), the 2026-10-17 decisions, and dated notes where earlier text no longer holds; FEDERATION.md's
  FEP list (7888, f228, 7628, ae0c and 8967 supported) and the deploy's persona.

Verified: dotnet build PrivaPub.sln -c Release (0 errors, no new warnings); bash -n on the touched scripts; py_compile
on the town; the pasture's gts, mastodon and lemmy scenarios on this build.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

PrivaPub/Services/RootUsersService.cs

@@ -1,14 +1,8 @@
-using MailKit.Net.Smtp;
-
 using Microsoft.Extensions.Localization;
 
-using MimeKit;
-
 using MongoDB.Driver;
 using MongoDB.Entities;
 
-using PasswordGenerator;
-
 using PrivaPub.ClientModels;
 using PrivaPub.ClientModels.User;
 using PrivaPub.Models;
@@ -33,7 +27,6 @@ namespace PrivaPub.Services
 		readonly IStringLocalizer Localizer;
 		readonly ILogger<RootUsersService> Logger;
 		readonly AppConfigurationService AppConfigurationService;
-		readonly AuthTokenManager AuthTokenManager;
 		readonly IJobQueue Jobs;
 		readonly IRootSessions Sessions;
 		readonly IRootRemoval Removal;
@@ -46,14 +39,12 @@ namespace PrivaPub.Services
 			ILogger<RootUsersService> logger,
 			IPasswordHasher passwordHasher,
 			DbEntities dbEntities,
-			AppConfigurationService appConfigurationService,
-			AuthTokenManager authTokenManager)
+			AppConfigurationService appConfigurationService)
 		{
 			Jobs = jobs;
 			Sessions = sessions;
 			Removal = removal;
 			DbEntities = dbEntities;
-			AuthTokenManager = authTokenManager;
 			PasswordHasher = passwordHasher;
 			Localizer = localizer;
 			Logger = logger;
@@ -66,8 +57,7 @@ namespace PrivaPub.Services
 		// a hash nobody's password matches, so an unknown login costs the same hashing as a wrong password
 		string Decoy => _decoy ??= PasswordHasher.Hash(Convert.ToHexString(System.Security.Cryptography.RandomNumberGenerator.GetBytes(16)));
 
-		public async Task<WebResult> SignUpAsync(LoginForm signUpForm, string invitationCode = default,
-			bool isPasswordRequired = false)
+		public async Task<WebResult> SignUpAsync(LoginForm signUpForm)
 		{
 			var result = new WebResult();
 			try
@@ -98,23 +88,6 @@ namespace PrivaPub.Services
 				};
 				await DB.Default.SaveAsync(newUser);
 
-				//if (!string.IsNullOrEmpty(invitationCode))
-				//{
-				//	if (isPasswordRequired)
-				//		result = await DiscussionService.InviteUserToDiscussion(new PwDiscussionPreviewForm
-				//		{
-				//			InvitationCode = invitationCode,
-				//			Password = signUpForm.InvitationPassword
-				//		}, newUser.ID);
-				//	else
-				//		result = await DiscussionService.InviteUserToDiscussion(new NoPwDiscussionPreviewForm
-				//		{
-				//			InvitationCode = invitationCode,
-				//		}, newUser.ID);
-				//	if (!result.IsValid)
-				//		return result;
-				//}
-
 				result.Data = (newUser, ToViewSettings(newUser.Settings));
 
 				return result;
@@ -126,8 +99,7 @@ namespace PrivaPub.Services
 			}
 		}
 
-		public async Task<WebResult> LoginAsync(LoginForm loginForm, string invitationCode = default,
-			bool isPasswordRequired = false)
+		public async Task<WebResult> LoginAsync(LoginForm loginForm)
 		{
 			var result = new WebResult();
 			try
@@ -148,23 +120,6 @@ namespace PrivaPub.Services
 				var userSettingsResult = await GetUserSettingsAsync(user.ID, loginForm);
 				var userSettings = (ViewUserSettings)userSettingsResult.Data;
 
-				//if (!string.IsNullOrEmpty(invitationCode))
-				//{
-				//	if (isPasswordRequired)
-				//		result = await DiscussionService.InviteUserToDiscussion(new PwDiscussionPreviewForm
-				//		{
-				//			InvitationCode = invitationCode,
-				//			Password = loginForm.InvitationPassword
-				//		}, user.ID);
-				//	else
-				//		result = await DiscussionService.InviteUserToDiscussion(new NoPwDiscussionPreviewForm
-				//		{
-				//			InvitationCode = invitationCode,
-				//		}, user.ID);
-				//	if (!result.IsValid)
-				//		return result;
-				//}
-
 				result.Data = (user, userSettings);
 
 				return result;