cleanup: drop stale tombstones and dead config fields

Stale comments referencing completed migrations:
- universe.py "remain live until step 10 of Phase G" — endpoints gone
- api.py "Portfolio endpoints moved to universe.py" — empty block
- csv_import.py "persist_pie removed in Phase G" — historical context

Dead Settings fields (all confirmed unreferenced by app code):
- CASSANDRA_PORT — port is hardcoded in docker-compose / uvicorn cmd
- POLAR_API_KEY — Polar was replaced by Stripe
- CASSANDRA_MOCK — env var still set by tests as a sentinel; the
  Settings field itself was never read
- CASSANDRA_BASE_CURRENCY — "GBP" hardcoded inline elsewhere

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

app/config.py

@@ -42,7 +42,6 @@ class Settings(BaseSettings):
 
     # App
     CASSANDRA_TOKEN: str = ""
-    CASSANDRA_PORT: int = 8000
     # Signing key for session cookies. Generate with:
     #   python -c "import secrets; print(secrets.token_urlsafe(32))"
     # Falls back to CASSANDRA_TOKEN if unset (acceptable for single-host dev).
@@ -59,9 +58,7 @@ class Settings(BaseSettings):
     SMTP_PASSWORD: str = ""
     SMTP_USE_TLS: bool = True
     SMTP_FROM: str = ""    # Defaults to SMTP_USER if blank
-    CASSANDRA_BASE_CURRENCY: str = "GBP"
     CASSANDRA_ANCHOR_DATE: str = ""
-    CASSANDRA_MOCK: bool = False
 
     # Server-side pepper for the cloud-sync outer wrap. Generate with:
     #   python -c "import secrets; print(secrets.token_urlsafe(32))"
@@ -97,7 +94,6 @@ class Settings(BaseSettings):
     # env var. Empty = webhook endpoint refuses with 503 (so a misconfig
     # is loud rather than silently accepting unsigned events).
     POLAR_WEBHOOK_SECRET: str = ""
-    POLAR_API_KEY: str = ""
 
     # Stripe (merchant-on-record for read.markets after Polar/Paddle
     # both declined the financial-media category). Test-mode keys are