step 5 (partial): strip dropped packages from production code

Removed all references to dropped packages in non-test code.
Zero dropped imports, store refs, or model types remaining.

Major removals:
  - scheduler/ package (entire dir) — tasks moved to extension track
  - taskutil/ package (entire dir)
  - health/ package (entire dir) — provider/tool health
  - sandbox/provider_module.go — provider.complete module
  - handlers: workflow_entry, workflow_instances, workflow_forms,
    workflow_assignments, workflow_monitor, health_admin (6 files)
  - auth/session.go, middleware/session_auth.go
  - store/{postgres,sqlite}/sessions.go, tasks.go

Rewrites:
  - store/{postgres,sqlite}/health.go — kernel-only Prune
    (ws_tickets, rate_limit_counters, stale presence)
  - handlers/admin.go: 847→467 lines (stripped provider CRUD)
  - handlers/teams.go: 520→411 lines (stripped model listing)
  - sandbox/runner.go: removed ProviderResolver
  - sandbox/workflow_module.go: 216→83 lines (definition-only)
  - main.go: 1579→1325 lines (stripped dropped package init)
  - pages/pages.go: stripped channel/session lookups
  - events/types.go: stripped chat/channel/workspace event routes
  - models: stripped stale types, constants, notification types

Store interface cleanup:
  - Removed SessionStore, TaskStore from Stores struct
  - Stripped workflow assignment methods from WorkflowStore iface
  - Stripped assignment methods from PG+SQLite workflow stores
  - Updated testhelper.go table list to kernel-only

Migrations: removed 008_tasks.sql (both dialects)

-9665/+69 lines across 51 files.

server/middleware/session_auth.go

@@ -1,110 +0,0 @@
-package middleware
-
-import (
-	"net/http"
-	"strings"
-
-	"github.com/gin-gonic/gin"
-
-	"switchboard-core/auth"
-	"switchboard-core/config"
-	"switchboard-core/database"
-	"switchboard-core/store"
-)
-
-// AuthOrSession returns middleware that accepts either a normal JWT or a
-// session cookie. Authenticated users get the standard context values
-// (user_id, email, role, auth_type="user"). Session visitors get
-// session_id, channel_id, and auth_type="session".
-//
-// Session auth is only valid for workflow channels with allow_anonymous=true.
-func AuthOrSession(cfg *config.Config, stores store.Stores, cache *UserStatusCache) gin.HandlerFunc {
-	return func(c *gin.Context) {
-		// Skip auth when running without a database
-		if !database.IsConnected() {
-			c.Next()
-			return
-		}
-
-		// ── Try normal JWT auth first ──
-		tokenString := extractBearerToken(c)
-		if tokenString != "" {
-			if claims, ok := parseAndValidateJWT(tokenString, cfg.JWTSecret); ok {
-				role, valid := verifyUser(c, claims, stores.Users, cache)
-				if !valid {
-					return
-				}
-				c.Set("user_id", claims.UserID)
-				c.Set("email", claims.Email)
-				c.Set("role", role)
-				c.Set("auth_type", "user")
-				c.Next()
-				return
-			}
-		}
-
-		// ── Try sb_token cookie (page auth pattern) ──
-		if cookie, err := c.Cookie("sb_token"); err == nil && cookie != "" {
-			if claims, ok := parseAndValidateJWT(cookie, cfg.JWTSecret); ok {
-				role, valid := verifyUser(c, claims, stores.Users, cache)
-				if !valid {
-					return
-				}
-				c.Set("user_id", claims.UserID)
-				c.Set("email", claims.Email)
-				c.Set("role", role)
-				c.Set("auth_type", "user")
-				c.Next()
-				return
-			}
-		}
-
-		// ── Fall back to session auth ──
-		channelID := c.Param("id") // channel routes use :id
-		if channelID == "" {
-			channelID = c.Param("channelId")
-		}
-		if channelID == "" {
-			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "authentication required"})
-			return
-		}
-
-		// Verify channel exists, is workflow type, and allows anonymous
-		chType, allowAnon, err := stores.Channels.GetTypeAndAllowAnonymous(c.Request.Context(), channelID)
-		if err != nil {
-			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "authentication required"})
-			return
-		}
-		if chType != "workflow" || !allowAnon {
-			c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error": "anonymous access not permitted on this channel"})
-			return
-		}
-
-		session, err := auth.CreateOrResumeSession(c, stores, channelID, cfg)
-		if err != nil {
-			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "session creation failed"})
-			return
-		}
-
-		c.Set("session_id", session.ID)
-		c.Set("session_token", session.SessionToken)
-		c.Set("channel_id", channelID)
-		c.Set("auth_type", "session")
-		c.Next()
-	}
-}
-
-// extractBearerToken gets the JWT from Authorization header or ?token= query param.
-func extractBearerToken(c *gin.Context) string {
-	header := c.GetHeader("Authorization")
-	if header == "" {
-		if qToken := c.Query("token"); qToken != "" {
-			return qToken
-		}
-		return ""
-	}
-	if strings.HasPrefix(header, "Bearer ") {
-		return strings.TrimPrefix(header, "Bearer ")
-	}
-	return ""
-}