refactor(split): make the app self-hosting ready

Remove the transitional website auth, admin hooks, SEO and hosted analytics together, then align the app routes, runtime configuration, tests and dependencies. These changes form one atomic cleanup because the filtered app must switch its identity and runtime surfaces as a unit.

server/api/auth/logout.post.ts

@@ -1,27 +1,7 @@
 import { defineEventHandler } from 'h3'
-import { clearRefreshTokenCookie, getUserFromEvent } from '../../utils/auth'
-import { getAuthMode } from '../../utils/authMode'
 import { clearAppSession } from '../../utils/session'
 
 export default defineEventHandler(async (event) => {
-  // Always drop the app's own session, whatever else happens below.
   clearAppSession(event)
-
-  // AUTH_MODE=open has no session to end — the local identity is the instance.
-  if (getAuthMode() === 'open') {
-    return { success: true }
-  }
-
-  const user = await getUserFromEvent(event)
-
-  // PHASE 1 (app repo): drop this branch. Bumping tokenVersion invalidates the
-  // website's outstanding access tokens; an app session is ended by clearing
-  // the cookie above. `tokenVersion` only exists on website User documents.
-  if (user && typeof (user as any).tokenVersion === 'number') {
-    ;(user as any).tokenVersion += 1
-    await user.save().catch(() => null)
-  }
-
-  clearRefreshTokenCookie(event)
   return { success: true }
 })