refactor(api): remove 5 dead routes + stale deprecation markers

An audit (backend /api routes vs SvelteKit frontend usage, adversarially
verified across the whole repo) found these 5 routes have ZERO callers — no
frontend, no test, no protocol layer, no internal caller — and are superseded:

- GET  /api/folders/paginated            no-op duplicate of GET /api/folders
                                         (discards the page arg); superseded by
                                         the cursor-paginated /{id}/resources.
- POST /api/dedup/upload                 superseded by /api/files/upload, which
                                         does the identical CDC dedup ingest.
- POST /api/people/{id}/hide             the hide-person toggle was never built
                                         into the UI (is_hidden never read).
- GET  /api/admin/settings/general       never called anywhere.
- GET  /api/admin/settings/registration  only the PUT is used; the GET had no
                                         caller (PUT kept).

Removes each route, its handler + _impl, the now-orphaned DedupUploadResponse
DTO + its two serialization tests, the set_hidden service method (only caller
was hide_person), and the OpenAPI path/schema registrations.

Also cleans 4 stale markers: two #[allow(deprecated)] that no longer suppress
anything (zero #[deprecated] remain), the "Legacy folder endpoints (contents,
listing)" comment (both already removed), and a "Re-export AppError for backward
compatibility" comment describing a re-export that doesn't exist.

Net -323 lines. The 31 other unused-by-frontend routes (device-code auth,
CardDAV contact-groups, people/photos & music WIP, dedup/admin debug, i18n,
openapi.json) are intentional surface and were left untouched.

cargo clippy --all-features --all-targets -D warnings: clean. cargo test: 446 passed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/interfaces/api/handlers/people_handler.rs

@@ -88,30 +88,6 @@ pub async fn rename_person(
     }
 }
 
-#[derive(Deserialize)]
-pub struct HideBody {
-    pub hidden: bool,
-}
-
-/// POST /api/people/{id}/hide — hide/unhide a person from the grid.
-pub async fn hide_person(
-    State(state): State<Arc<AppState>>,
-    auth_user: AuthUser,
-    Path(id): Path<String>,
-    Json(body): Json<HideBody>,
-) -> Response {
-    let Some(svc) = state.people_service.as_ref() else {
-        return disabled();
-    };
-    let Ok(person_id) = Uuid::parse_str(&id) else {
-        return bad_id();
-    };
-    match svc.set_hidden(auth_user.id, person_id, body.hidden).await {
-        Ok(()) => StatusCode::NO_CONTENT.into_response(),
-        Err(e) => AppError::from(e).into_response(),
-    }
-}
-
 #[derive(Deserialize)]
 pub struct MergeBody {
     pub into: String,