nessa: retire the API copy now served by nessa-api.freno.me

The Nessa API (nessaDb.*, nessa.community.*, Clerk auth and the Clerk user
webhook) lives in the Nessa repo's server/ on pan. This copy never served
the app: RemoteAPIClient wraps every input in {"input": …}, which the stock
tRPC adapter here reads as the input itself (queries 404, writes no-op).
Clerk's webhook already targets nessa-api.freno.me.

Drops the routers, nessa-auth, the webhook, NessaConnectionFactory, the
NESSA_* env and the now-unused @clerk/backend and svix. Nessa's marketing,
privacy and deletion pages stay.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/env/server.ts

@@ -53,18 +53,7 @@ const serverEnvSchema = z.object({
   VITE_WEBSOCKET: z.string().min(1),
   VITE_INFILL_ENDPOINT: z.string().min(1),
   INFILL_BEARER_TOKEN: z.string().min(1),
-  NESSA_DB_URL: z.string().min(1),
-  NESSA_DB_TOKEN: z.string().min(1),
-  // Clerk authentication — Nessa auth is now Clerk-backed. The
-  // legacy self-issued JWT signing env var was removed.
-  NESSA_CLERK_SECRET: z.string().min(1),
-  NESSA_CLERK_JWT_ISSUER: z.string().min(1),
-  // Clerk webhook signing secret (Svix). Used to verify `user.created` /
-  // `user.updated` webhook payloads. Find it under Clerk Dashboard →
-  // Webhooks → your endpoint → Signing Secret (starts with `whsec_`).
-  NESSA_CLERK_WEBHOOK_SECRET: z.string().min(1),
   LINEAGE_JWT_SECRET: z.string().min(32),
-  APPLE_CLIENT_ID_NESSA: z.string().min(1).optional(),
   APPLE_CLIENT_ID_LINEAGE: z.string().min(1).optional(),
   VITE_TURNSTILE_SITE_KEY: z.string().min(1),
   TURNSTILE_SECRET_KEY: z.string().min(1),
@@ -183,11 +172,6 @@ export const getMissingEnvVars = (): string[] => {
     "VITE_GOOGLE_CLIENT_ID_MAGIC_DELVE",
     "VITE_GITHUB_CLIENT_ID",
     "VITE_WEBSOCKET",
-    "NESSA_DB_URL",
-    "NESSA_DB_TOKEN",
-    "NESSA_CLERK_SECRET",
-    "NESSA_CLERK_JWT_ISSUER",
-    "NESSA_CLERK_WEBHOOK_SECRET",
     "LINEAGE_JWT_SECRET"
   ];