#1041 #931 T1+T2+T6: delete dead, no-op and unused routes and the /admin/tokens credential type

EARS SPEC: - The Highway API shall not serve the T1 routes (/api/v1/../u/<token>, shadowed version.get_version, POST /schedules/scan, POST /apps/cache/clear, POST /apps/<id>/reload, POST /circuit-breakers/reset, /static/*, /favicon.ico, /ping), the 31 T2 inspection/analytics pairs, or the 5 T6 /admin/tokens* pairs listed in SPECS/931-route-classification.md; each shall answer 404 (or 405 where a sibling method on the same path survives). - If a bearer token minted by the removed /admin/tokens flow is presented, then the API shall reject it with 401 exactly as any unknown token; hw_k1_ keys and OIDC sessions shall keep authenticating (D5). - Every route not in T1/T2/T6 shall keep its method set and permission (route permission guard test #1032 stays green; the route table diff contains only the removed pairs). - Tests that targeted removed routes shall be retargeted to a surviving route or deleted, with the reason recorded. - HEAD on /api/v1/health and every surviving liveness route shall keep the GET semantics. Owner approved T1, T2, T6 on 2026-10-22. Parent #931. Dashboard callers (lib/api/system.ts cache reset, lib/api/admin.ts tokens UI) are told over AgentBus before deploy.