step 5 (partial): strip dropped packages from production code

Removed all references to dropped packages in non-test code.
Zero dropped imports, store refs, or model types remaining.

Major removals:
  - scheduler/ package (entire dir) — tasks moved to extension track
  - taskutil/ package (entire dir)
  - health/ package (entire dir) — provider/tool health
  - sandbox/provider_module.go — provider.complete module
  - handlers: workflow_entry, workflow_instances, workflow_forms,
    workflow_assignments, workflow_monitor, health_admin (6 files)
  - auth/session.go, middleware/session_auth.go
  - store/{postgres,sqlite}/sessions.go, tasks.go

Rewrites:
  - store/{postgres,sqlite}/health.go — kernel-only Prune
    (ws_tickets, rate_limit_counters, stale presence)
  - handlers/admin.go: 847→467 lines (stripped provider CRUD)
  - handlers/teams.go: 520→411 lines (stripped model listing)
  - sandbox/runner.go: removed ProviderResolver
  - sandbox/workflow_module.go: 216→83 lines (definition-only)
  - main.go: 1579→1325 lines (stripped dropped package init)
  - pages/pages.go: stripped channel/session lookups
  - events/types.go: stripped chat/channel/workspace event routes
  - models: stripped stale types, constants, notification types

Store interface cleanup:
  - Removed SessionStore, TaskStore from Stores struct
  - Stripped workflow assignment methods from WorkflowStore iface
  - Stripped assignment methods from PG+SQLite workflow stores
  - Updated testhelper.go table list to kernel-only

Migrations: removed 008_tasks.sql (both dialects)

-9665/+69 lines across 51 files.

server/handlers/teams.go

@@ -14,7 +14,6 @@ import (
 	"switchboard-core/crypto"
 	"switchboard-core/database"
 	"switchboard-core/models"
-	"switchboard-core/providers"
 	"switchboard-core/store"
 )
 
@@ -346,91 +345,6 @@ func (h *TeamHandler) MyTeams(c *gin.Context) {
 	c.JSON(http.StatusOK, gin.H{"data": teams})
 }
 
-// ── Team Models: Available for Personas ──────
-
-// ListAvailableModels returns models with visibility 'enabled' or 'team'
-// for team admins building personas. Requires RequireTeamAdmin middleware.
-// GET /api/v1/teams/:teamId/models
-func (h *TeamHandler) ListAvailableModels(c *gin.Context) {
-	teamID := getTeamID(c)
-	ctx := c.Request.Context()
-
-	type availableModel struct {
-		ID           string  `json:"id"`
-		ModelID      string  `json:"model_id"`
-		DisplayName  *string `json:"display_name"`
-		Visibility   string  `json:"visibility"`
-		Provider     string  `json:"provider"`
-		ProviderName string  `json:"provider_name"`
-		Source       string  `json:"source"`
-	}
-
-	result := make([]availableModel, 0)
-
-	// ── 1. Global admin models (synced in model_catalog) ──
-	catalogModels, err := h.stores.Catalog.ListTeamAvailable(ctx)
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "query failed"})
-		return
-	}
-	for _, cm := range catalogModels {
-		result = append(result, availableModel{
-			ID:           cm.ID,
-			ModelID:      cm.ModelID,
-			DisplayName:  cm.DisplayName,
-			Visibility:   cm.Visibility,
-			Provider:     cm.Provider,
-			ProviderName: cm.ProviderName,
-			Source:       "global",
-		})
-	}
-
-	// ── 2. Team provider models (live query) ──
-	teamConfigs, err := h.stores.Providers.ListForTeam(ctx, teamID)
-	if err == nil {
-		for _, cfg := range teamConfigs {
-			provider, pErr := providers.Get(cfg.Provider)
-			if pErr != nil {
-				continue
-			}
-
-			key := ""
-			if cfg.HasKey() {
-				key = string(cfg.APIKeyEnc)
-			}
-
-			var customHeaders map[string]string
-			if cfg.Headers != nil {
-				b, _ := json.Marshal(cfg.Headers)
-				_ = json.Unmarshal(b, &customHeaders)
-			}
-
-			provModels, lErr := provider.ListModels(ctx, providers.ProviderConfig{
-				Endpoint:      cfg.Endpoint,
-				APIKey:        key,
-				CustomHeaders: customHeaders,
-			})
-			if lErr != nil {
-				log.Printf("[models] team provider %q list failed: %v", cfg.Name, lErr)
-				continue
-			}
-
-			for _, pm := range provModels {
-				result = append(result, availableModel{
-					ID:           pm.ID,
-					ModelID:      pm.ID,
-					Provider:     cfg.Provider,
-					ProviderName: cfg.Name,
-					Visibility:   "enabled",
-					Source:       "team",
-				})
-			}
-		}
-	}
-
-	c.JSON(http.StatusOK, gin.H{"data": result})
-}
-
 // ── Helpers ─────────────────────────────────
 
 // getTeamID extracts team ID from either :id (admin routes) or :teamId (team-scoped routes).
@@ -441,30 +355,6 @@ func getTeamID(c *gin.Context) string {
 	return c.Param("id")
 }
 
-// enforcePrivateProviderPolicy checks if a user belongs to any team that
-// requires private providers, and if so, verifies the resolved config is
-// marked as private. Returns nil if allowed, error if blocked.
-func enforcePrivateProviderPolicy(ctx context.Context, stores store.Stores, userID, configID string) error {
-	if configID == "" {
-		return nil
-	}
-
-	requiresPrivate, err := stores.Teams.HasPrivateProviderRequirement(ctx, userID)
-	if err != nil || !requiresPrivate {
-		return nil
-	}
-
-	// User is in a restricted team — verify the config is private
-	cfg, err := stores.Providers.GetByID(ctx, configID)
-	if err != nil {
-		return nil // config lookup failed, allow (fail open)
-	}
-	if !cfg.IsPrivate {
-		return fmt.Errorf("your team requires private providers — this provider sends data externally")
-	}
-	return nil
-}
-
 // ── Team Audit Log (scoped to team members) ─
 
 func (h *TeamHandler) ListTeamAuditLog(c *gin.Context) {