refactor(webapp): drop ApiAuthenticationResultSuccess.scopes + delete dead authorization.server.ts

Two related cleanups falling out of the RBAC migration.

The `scopes?: string[]` field on `ApiAuthenticationResultSuccess` was
populated from JWT claims by the legacy auth path and consumed only
by `services/authorization.server.ts`'s `checkAuthorization`. The new
apiBuilder bridge (which constructs the same result type) doesn't
populate scopes, and every call site has migrated to the rbac
ability model. Verified by grep: no handler reads
`authentication.scopes` / `authenticationResult.scopes` anywhere
outside the dead `authorization.server` module.

A perpetually-undefined optional field is a footgun — future code
might branch on it and silently misbehave. Drop it from the type and
remove the two dead-write populations in `authenticateApiKey` and
`authenticateApiKeyWithFailure`.

`services/authorization.server.ts` (the file that defined
`AuthorizationEntity`, `AuthorizationResources`, and the
`checkAuthorization` function) is wholly dead — nothing in
`apps/webapp/app` imports it any more. Delete it. The route comments
that reference "the legacy `checkAuthorization`" are kept for
historical context.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: matt-aitken

apps/webapp/app/services/apiAuth.server.ts

@@ -52,7 +52,6 @@ export type ApiAuthenticationResultSuccess = {
   apiKey: string;
   type: "PUBLIC" | "PRIVATE" | "PUBLIC_JWT";
   environment: AuthenticatedEnvironment;
-  scopes?: string[];
   oneTimeUse?: boolean;
   realtime?: {
     skipColumns?: string[];
@@ -163,7 +162,6 @@ export async function authenticateApiKey(
         ok: true,
         ...result,
         environment: validationResults.environment,
-        scopes: parsedClaims.success ? parsedClaims.data.scopes : [],
         oneTimeUse: parsedClaims.success ? parsedClaims.data.otu : false,
         realtime: parsedClaims.success ? parsedClaims.data.realtime : undefined,
       };
@@ -246,7 +244,6 @@ async function authenticateApiKeyWithFailure(
         ok: true,
         ...result,
         environment: validationResults.environment,
-        scopes: parsedClaims.success ? parsedClaims.data.scopes : [],
         oneTimeUse: parsedClaims.success ? parsedClaims.data.otu : false,
         realtime: parsedClaims.success ? parsedClaims.data.realtime : undefined,
       };