chore: remove confirmed dead code

Dead code sweep verified manually against app.routes.ts, DI registries, and
cross-repo grep for every candidate (per prior false-positive incident with
knip on pages/**). Deleted only what has zero reachable reference:

Auth (unregistered, comment-only mention):
- core/auth/guards/ed25519-auth.guard.ts - ed25519AuthGuard never imported;
  only mentioned inside a doc-comment in admin-login-page.component.ts.
- core/auth/guards/permission.guard.ts - permissionGuard never imported.
- core/auth/interceptors/auth.interceptor.ts - authInterceptor not present
  in app.config.ts's withInterceptors([...]) list; not imported elsewhere.

Search feature:
- features/search/services/search-analytics.service.ts - SearchAnalyticsService
  never imported outside its own file.
- features/search/components/empty-results/* - app-search-empty-results
  selector never used in any template; search-bar.component.html implements
  its own inline @if (noResults) empty state instead.

Content management:
- features/content-management/pages/content-management-page.component.ts -
  thin wrapper around StaticPagesEditorComponent with zero route pointing at
  it in app.routes.ts. The rest of features/content-management/* (facade,
  static-pages-editor, page-editor, etc.) remains: it is used by
  project-editor and stays.

Backoffice CRUD scaffolding (re-verified the UI-COMPOSITION-REVIEW.md claim
independently): app.routes.ts backoffice section only loads
features/admin/{dashboard,products,categories,transactions,orders,customers,
moderation,users,monitoring,analytics} and features/backoffice/media. Grepped
every other backoffice/* folder for cross-references - none found.
- features/backoffice/{categories,customers,inventory,orders,products,settings}
  - each contained only a placeholder .gitkeep from the original scaffold
  commit (b957112); no real components were ever added, so this is not the
  "duplicate implementation" the prior doc described, just unused scaffold
  dirs. Removing corrects that doc's premise.
- features/backoffice/shared/backoffice-coming-soon-page.component.* - only
  consumer would have been those scaffold dirs; unreferenced elsewhere.
- assets/mock/backoffice/{customers,orders}/list.json - mock data with no
  corresponding fetch call; BackofficeDataProvider only exposes
  loadProducts()/loadCategories(), backed by the products/categories mock
  files, which are kept.

Dead shared barrels/models (no importer anywhere in src/app):
- shared/index.ts, shared/models/index.ts, shared/types/index.ts - unused
  re-export barrels.
- shared/models/domain/index.ts + user-preferences.model.ts (whole domain/
  subfolder) - UserPreferences interface has zero consumers.

Storefront pages (pages/public/platform-home.component.ts) - PlatformHomeComponent
has no route in app.routes.ts and is not imported anywhere; distinct from the
pages/category, pages/search, pages/info/**, pages/legal/**, pages/item-detail
components which ARE routed and were correctly left untouched.

Verification: npx tsc --noEmit -p tsconfig.app.json clean after each batch;
npm run build succeeded (pre-existing initial-bundle-budget warning only,
unrelated to this change).

src/app/core/auth/guards/ed25519-auth.guard.ts

@@ -1,25 +0,0 @@
-import { inject } from '@angular/core';
-import { CanActivateFn, Router } from '@angular/router';
-import { SessionService } from '../services/session.service';
-
-/**
- * Guards routes under the Ed25519 JWT flow. Not wired onto any live route
- * yet (see docs/AUTH.md cutover plan) - `adminAuthGuard`
- * (`core/admin-auth/admin-auth.guard.ts`) remains the active guard for
- * `/backoffice` and `/edit` until the backend ships the challenge/verify
- * endpoints this depends on.
- */
-export const ed25519AuthGuard: CanActivateFn = () => {
-  const session = inject(SessionService);
-  const router = inject(Router);
-
-  if (session.isAuthenticated()) {
-    return true;
-  }
-
-  if (session.status() === 'expired') {
-    return router.parseUrl('/admin-login/error/session-expired');
-  }
-
-  return router.parseUrl('/admin-login');
-};

src/app/core/auth/guards/permission.guard.ts

@@ -1,25 +0,0 @@
-import { inject } from '@angular/core';
-import { CanActivateFn, Router } from '@angular/router';
-import { Permission } from '../models/permission.model';
-import { PermissionService } from '../services/permission.service';
-import { SessionService } from '../services/session.service';
-
-/**
- * Factory guard: `permissionGuard('users.manage')` in a route's
- * `canActivate`. Composes with `ed25519AuthGuard` - route to this only after
- * confirming authentication, since an unauthenticated user has no role and
- * would otherwise always be routed to `forbidden` instead of the login page.
- */
-export function permissionGuard(required: Permission): CanActivateFn {
-  return () => {
-    const session = inject(SessionService);
-    const permissions = inject(PermissionService);
-    const router = inject(Router);
-
-    if (!session.isAuthenticated()) {
-      return router.parseUrl('/admin-login');
-    }
-
-    return permissions.has(required) ? true : router.parseUrl('/admin-login/error/forbidden');
-  };
-}

src/app/core/auth/interceptors/auth.interceptor.ts

@@ -1,46 +0,0 @@
-import { HttpErrorResponse, HttpInterceptorFn } from '@angular/common/http';
-import { inject } from '@angular/core';
-import { Router } from '@angular/router';
-import { catchError, switchMap, throwError } from 'rxjs';
-import { SessionService } from '../services/session.service';
-import { AuthService } from '../services/auth.service';
-
-/** Paths gated by the Ed25519 JWT once it is the live admin auth mechanism. Kept identical to adminAuthHeadersInterceptor's list for consistency. */
-const ADMIN_GATED_PATH_SEGMENTS = ['/admin/', '/backoffice/', '/builder/', '/media/'];
-
-/**
- * Attaches `Authorization: Bearer <jwt>` to admin API requests and, on a 401,
- * attempts a single silent refresh-then-retry before giving up and routing
- * to the session-expired screen. Not registered in app.config.ts yet - this
- * activates once the Ed25519 flow replaces (or runs alongside)
- * adminAuthHeadersInterceptor; see docs/AUTH.md for the cutover plan.
- */
-export const authInterceptor: HttpInterceptorFn = (req, next) => {
-  const isAdminRequest = ADMIN_GATED_PATH_SEGMENTS.some(segment => req.url.includes(segment));
-  if (!isAdminRequest) {
-    return next(req);
-  }
-
-  const session = inject(SessionService);
-  const auth = inject(AuthService);
-  const router = inject(Router);
-
-  const token = session.token();
-  const authedReq = token ? req.clone({ headers: req.headers.set('Authorization', `Bearer ${token}`) }) : req;
-
-  return next(authedReq).pipe(
-    catchError((error: unknown) => {
-      if (!(error instanceof HttpErrorResponse) || error.status !== 401 || !session.getRefreshToken()) {
-        return throwError(() => error);
-      }
-
-      return auth.refresh().pipe(
-        switchMap(refreshed => next(req.clone({ headers: req.headers.set('Authorization', `Bearer ${refreshed.token}`) }))),
-        catchError(refreshError => {
-          router.navigate(['/admin-login/error', 'session-expired']);
-          return throwError(() => refreshError);
-        })
-      );
-    })
-  );
-};