chore(frontend): remove the legacy vanilla-JS frontend and its tooling

The SvelteKit app under /frontend has fully superseded the legacy
vanilla-JS/CSS frontend in /static, which was only ever served by a
debug `cargo run` / `PROFILE=dev` and never shipped to production.
Remove it together with the whole subsystem that existed only to
support it (~54k lines).

Frontend & assets:
- Delete /static (js/, css/, *.html, sw.js, basemaps/, locales symlink).
- Relocate the brand/PWA assets (logo/, favicon.ico, manifest.webmanifest)
  to frontend/static/ so they ship with the SPA. This also fixes the
  favicon, which app.html referenced but was missing from the prod bundle.
- Migrate the Nextcloud login-flow redirects from /nextcloud-error.html
  to the SvelteKit /nextcloud/error route.

Web layer:
- Simplify resolve_static_path: drop the PROFILE=dev branch; always prefer
  the Vite static-dist/ build, fall back to the configured path.
- Resolve i18n locales from the served SPA dir with a frontend/static
  fallback so `just dev` works without a prior build.

Build:
- Prune build.rs from 1262 to ~70 lines (git metadata only); the Rust asset
  pipeline and the OXICLOUD_RUST_ASSETS rollback flag are gone.
- Drop the now-unused build-dependencies (oxc_*, lightningcss).
- Remove the COPY static lines from the Dockerfile (cacher + builder).

Tooling & docs:
- Delete biome.json, jsconfig.json, tools/check-*.py, identifier.sh.
- Remove the legacy front-* justfile recipes; repoint the design-system
  scripts (locales, dead-tokens, brand-drift, token-docs) at the frontend,
  and drop check-contrast/check-headings (coupled to the old token
  taxonomy / multi-page HTML).
- Repoint docs/DESIGN-SYSTEM.md links; remove 5 superseded docs/plan/*.

Backend dead code:
- Remove the dead `folder_repo` field from FileBlobWriteRepository.
- Remove the deprecated GET /api/folders/{id}/listing endpoint
  (superseded by /resources).

Verified: cargo clippy (all-features/all-targets) clean, cargo test
--workspace 448 passed, cargo fmt clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/interfaces/nextcloud/login_v2_handler.rs

@@ -31,8 +31,7 @@ struct DrivePickerTemplate {
 
 /// The Nextcloud Login Flow v2 "Grant Access" page. Rendered server-side via
 /// askama (no template variables — the username/password are collected by the
-/// embedded form) instead of `include_str!` so the build no longer depends on
-/// the legacy `build.rs` static-asset pipeline / `OUT_DIR`.
+/// embedded form); the template is embedded at compile time by the derive macro.
 #[derive(Template)]
 #[template(path = "nextcloud/login.html")]
 struct NextcloudLoginTemplate;
@@ -264,7 +263,7 @@ pub async fn handle_login_submit(
             // Flow token vanished (TTL?) between password submit and
             // here — extremely unlikely but treat the same as any
             // session-expired case.
-            return axum::response::Redirect::to("/nextcloud-error.html?type=session-expired")
+            return axum::response::Redirect::to("/nextcloud/error?type=session-expired")
                 .into_response();
         }
         return render_drive_picker(&token, &drives);
@@ -365,7 +364,7 @@ async fn complete_flow(
             user = %user.username,
             "Login Flow v2: complete() returned false — flow token not found"
         );
-        axum::response::Redirect::to("/nextcloud-error.html?type=session-expired").into_response()
+        axum::response::Redirect::to("/nextcloud/error?type=session-expired").into_response()
     }
 }
 
@@ -402,7 +401,7 @@ pub async fn handle_drive_pick(
                 reason = "no_pending_user",
                 "👮🏻‍♂️ NC drive pick rejected: flow has no pending user (replay or unknown token)"
             );
-            return axum::response::Redirect::to("/nextcloud-error.html?type=session-expired")
+            return axum::response::Redirect::to("/nextcloud/error?type=session-expired")
                 .into_response();
         }
     };
@@ -516,7 +515,7 @@ pub async fn handle_login_oidc(
 
     // Verify the NC login flow token exists
     if !nextcloud.login_flow.flow_exists(&token) {
-        return axum::response::Redirect::to("/nextcloud-error.html?type=session-expired")
+        return axum::response::Redirect::to("/nextcloud/error?type=session-expired")
             .into_response();
     }
 
@@ -549,7 +548,7 @@ pub async fn handle_login_oidc(
 }
 
 fn login_failed_response(_err: DomainError) -> Response {
-    axum::response::Redirect::to("/nextcloud-error.html?type=invalid-credentials").into_response()
+    axum::response::Redirect::to("/nextcloud/error?type=invalid-credentials").into_response()
 }
 
 fn parse_form(body: &str) -> HashMap<String, String> {