chore(frontend): remove the legacy vanilla-JS frontend and its tooling

The SvelteKit app under /frontend has fully superseded the legacy
vanilla-JS/CSS frontend in /static, which was only ever served by a
debug `cargo run` / `PROFILE=dev` and never shipped to production.
Remove it together with the whole subsystem that existed only to
support it (~54k lines).

Frontend & assets:
- Delete /static (js/, css/, *.html, sw.js, basemaps/, locales symlink).
- Relocate the brand/PWA assets (logo/, favicon.ico, manifest.webmanifest)
  to frontend/static/ so they ship with the SPA. This also fixes the
  favicon, which app.html referenced but was missing from the prod bundle.
- Migrate the Nextcloud login-flow redirects from /nextcloud-error.html
  to the SvelteKit /nextcloud/error route.

Web layer:
- Simplify resolve_static_path: drop the PROFILE=dev branch; always prefer
  the Vite static-dist/ build, fall back to the configured path.
- Resolve i18n locales from the served SPA dir with a frontend/static
  fallback so `just dev` works without a prior build.

Build:
- Prune build.rs from 1262 to ~70 lines (git metadata only); the Rust asset
  pipeline and the OXICLOUD_RUST_ASSETS rollback flag are gone.
- Drop the now-unused build-dependencies (oxc_*, lightningcss).
- Remove the COPY static lines from the Dockerfile (cacher + builder).

Tooling & docs:
- Delete biome.json, jsconfig.json, tools/check-*.py, identifier.sh.
- Remove the legacy front-* justfile recipes; repoint the design-system
  scripts (locales, dead-tokens, brand-drift, token-docs) at the frontend,
  and drop check-contrast/check-headings (coupled to the old token
  taxonomy / multi-page HTML).
- Repoint docs/DESIGN-SYSTEM.md links; remove 5 superseded docs/plan/*.

Backend dead code:
- Remove the dead `folder_repo` field from FileBlobWriteRepository.
- Remove the deprecated GET /api/folders/{id}/listing endpoint
  (superseded by /resources).

Verified: cargo clippy (all-features/all-targets) clean, cargo test
--workspace 448 passed, cargo fmt clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/interfaces/web/mod.rs

@@ -14,26 +14,19 @@ use tower_http::set_header::SetResponseHeaderLayer;
 
 /// Resolve the directory the SPA is actually served from.
 ///
-/// Release builds prefer the Vite output next to the configured static path —
-/// `static-dist/`, or `static/` under `PROFILE=dev` — falling back to the
-/// configured path when that build dir is absent. Debug builds always use the
-/// configured path. Shared with the CSP layer in `main.rs` so the inline-script
-/// hashes are computed from exactly the bytes that get served.
+/// Prefers the Vite build output (`static-dist/`) sitting next to the configured
+/// static path, falling back to the configured path itself — the container ships
+/// the built SPA straight to `OXICLOUD_STATIC_PATH` (default `./static`), so there
+/// the fallback is what serves. Shared with the CSP layer in `main.rs` so the
+/// inline-script hashes are computed from exactly the bytes that get served.
 pub fn resolve_static_path(config: &AppConfig) -> PathBuf {
-    // `PROFILE=dev` (the `just front-dev`/legacy path) serves the unbuilt source
-    // dir; normal release serves the Vite output in `static-dist/`.
-    let is_dev = std::env::var("PROFILE").is_ok_and(|profile| profile == "dev");
-    let assets_dir = if is_dev { "static" } else { "static-dist" };
-
-    if cfg!(not(debug_assertions)) {
-        let dist = config
-            .static_path
-            .parent()
-            .unwrap_or(Path::new("."))
-            .join(assets_dir);
-        if dist.exists() {
-            return dist;
-        }
+    let dist = config
+        .static_path
+        .parent()
+        .unwrap_or(Path::new("."))
+        .join("static-dist");
+    if dist.exists() {
+        return dist;
     }
     config.static_path.clone()
 }
@@ -50,7 +43,6 @@ pub fn resolve_static_path(config: &AppConfig) -> PathBuf {
 /// can't leave a stale app pinned in browsers.
 pub fn create_web_routes() -> Router<Arc<AppState>> {
     let config = AppConfig::from_env();
-    let is_dev = std::env::var("PROFILE").is_ok_and(|profile| profile == "dev");
     let static_path = resolve_static_path(&config);
 
     // SPA fallback: serve the file if it exists, else the app shell.
@@ -59,12 +51,6 @@ pub fn create_web_routes() -> Router<Arc<AppState>> {
     // Hashed, immutable assets (SvelteKit emits these under /_app/immutable).
     let app_immutable = ServeDir::new(static_path.join("_app").join("immutable"));
 
-    let shell_cache = if is_dev {
-        "max-age=0, no-cache, no-store"
-    } else {
-        "no-cache"
-    };
-
     Router::new()
         .nest_service(
             "/_app/immutable",
@@ -75,10 +61,12 @@ pub fn create_web_routes() -> Router<Arc<AppState>> {
         )
         .fallback_service(spa)
         .layer(CompressionLayer::new().br(true).gzip(true))
-        // `if_not_present` so the immutable assets above keep their long cache.
+        // `if_not_present` so the immutable assets above keep their long cache;
+        // the shell itself must always revalidate so a deploy can't pin a stale
+        // app in browsers.
         .layer(SetResponseHeaderLayer::if_not_present(
             CACHE_CONTROL,
-            HeaderValue::from_static(shell_cache),
+            HeaderValue::from_static("no-cache"),
         ))
 }
 
@@ -148,8 +136,8 @@ pub fn content_security_policy(config: &AppConfig) -> String {
 /// each shell is read verbatim and that slice hashed. Scripts carrying a `src`
 /// attribute are external (already allowed by `'self'`) and skipped. Only the
 /// directory root is scanned — the SPA is client-rendered (SSR/prerender off),
-/// so the only inline-script shell is `index.html`; any legacy pages sit beside
-/// it. Returns a deduplicated, sorted list; empty when the dir is unreadable
+/// so the only inline-script shell is `index.html`. Returns a deduplicated,
+/// sorted list; empty when the dir is unreadable
 /// (e.g. a Vite dev server serving HTML on its own port instead).
 fn inline_script_csp_hashes(static_path: &Path) -> Vec<String> {
     let Ok(entries) = std::fs::read_dir(static_path) else {