chore: clean repo for enterprise production readiness

[RahRha-v3-2]

Fix CI failures and remove dead code so the build is reproducible.

Root cause of the failing CI build: services/auth-service and
services/progress-service pinned typeorm@^1.0.0, which has a strict peer
dependency on redis@^5.0.0 while the services declared redis@^4.6.12.
npm ci aborted with ERESOLVE.

Removals (junk / dead / mock):

• services/{auth,course,progress}-service — superseded by the gateway;
  every endpoint the legacy services exposed exists in api-gateway with
  test coverage. Eliminates the peer-dep break entirely.
• k8s/ — manifests only ever referenced the deleted services; api-gateway
  and frontend manifests never existed.
• frontend/src/ — dead Next.js code importing next/server, @/lib/auth,
  and modules that never existed. Not referenced by any build.
• frontend/Dockerfile — only consumed by the deleted compose files.
• api-server.py, test_server.py — alternate Python runtime, not part of
  the documented Node/TypeScript platform.
• deploy.sh, deploy-internet.sh, deployment-quickstart.sh,
  setup-ngrok-now.sh — replaced by deploy-vps.sh.
• start-api-gateway.sh, git-sync.sh — overlapped with start.sh; git-sync
  always pushed to main regardless of branch.
• docker/docker-compose.yml, docker/docker-compose.vps.yml,
  docker/Dockerfile.progress — referenced deleted services.
• .github/workflows/cd.yml, .github/workflows/infrastructure.yml — cd.yml
  pushed to a Docker Hub namespace that was never wired up;
  infrastructure.yml pointed at a non-existent terraform tree and rolled
  out deployments whose manifests didn't exist.
• infrastructure/aws/cloudformation.yaml — ECS template for the deleted
  multi-port topology.
• data/{users,progress,courses}.json — runtime artifacts (incl. a real
  bcrypt hash) that shouldn't be committed; data/courses-full.json is
  the documented canonical catalog.
• 13 overlapping top-level *.md files and docs/{deployment,
  troubleshooting}.md that described the legacy architecture and
  referenced removed files.

Mock-data removals in the gateway:

• routes/leaderboard.ts: fabricated "Marcus J. / Tamara L. / ..." users
  no longer returned in demo mode — empty array instead.
• routes/analytics.ts: hardcoded totalStudents/completionRate/avgRating
  replaced by real SQL counts (zero when no DB is configured).

CI workflow tightened: dropped the failing services matrix and the
service Docker builds; kept the api-gateway lint/typecheck/test/build,
Trivy scan, npm audit, and Docker image smoke-test.

Docs rewritten to match the live code: README, CLAUDE.md, CONTRIBUTING,
docs/architecture.md, docs/api-reference.md, .env.example.

Verified:

• npm run lint, typecheck, test, build all pass.
• 28 tests pass; coverage thresholds (60/60/28/60) still met.
• Production-mode smoke test (node dist/server.js) responds 200 on
  /health and shuts down on SIGTERM.