cleanup: drop stale tombstones and dead config fields

Stale comments referencing completed migrations:
- universe.py "remain live until step 10 of Phase G" — endpoints gone
- api.py "Portfolio endpoints moved to universe.py" — empty block
- csv_import.py "persist_pie removed in Phase G" — historical context

Dead Settings fields (all confirmed unreferenced by app code):
- CASSANDRA_PORT — port is hardcoded in docker-compose / uvicorn cmd
- POLAR_API_KEY — Polar was replaced by Stripe
- CASSANDRA_MOCK — env var still set by tests as a sentinel; the
  Settings field itself was never read
- CASSANDRA_BASE_CURRENCY — "GBP" hardcoded inline elsewhere

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

app/config.py

@@ -42,7 +42,6 @@ class Settings(BaseSettings):
 
     # App
     CASSANDRA_TOKEN: str = ""
-    CASSANDRA_PORT: int = 8000
     # Signing key for session cookies. Generate with:
     #   python -c "import secrets; print(secrets.token_urlsafe(32))"
     # Falls back to CASSANDRA_TOKEN if unset (acceptable for single-host dev).
@@ -59,9 +58,7 @@ class Settings(BaseSettings):
     SMTP_PASSWORD: str = ""
     SMTP_USE_TLS: bool = True
     SMTP_FROM: str = ""    # Defaults to SMTP_USER if blank
-    CASSANDRA_BASE_CURRENCY: str = "GBP"
     CASSANDRA_ANCHOR_DATE: str = ""
-    CASSANDRA_MOCK: bool = False
 
     # Server-side pepper for the cloud-sync outer wrap. Generate with:
     #   python -c "import secrets; print(secrets.token_urlsafe(32))"
@@ -97,7 +94,6 @@ class Settings(BaseSettings):
     # env var. Empty = webhook endpoint refuses with 503 (so a misconfig
     # is loud rather than silently accepting unsigned events).
     POLAR_WEBHOOK_SECRET: str = ""
-    POLAR_API_KEY: str = ""
 
     # Stripe (merchant-on-record for read.markets after Polar/Paddle
     # both declined the financial-media category). Test-mode keys are

app/routers/api.py

@@ -506,10 +506,6 @@ async def log_days(
     return templates.TemplateResponse(request, "partials/calendar.html", payload)
 
 
-# Portfolio endpoints moved to app/routers/universe.py (Phase G). The
-# server no longer persists per-user portfolio data; holdings live in
-# the browser's localStorage and prices come from /api/universe.
-
 
 # --- Health / ops footer -----------------------------------------------------
 

app/routers/universe.py

@@ -20,10 +20,7 @@ Four routes:
                                            held in memory for one LLM
                                            call, discarded on response.
 
-All routes require authentication (session cookie OR bearer token). The
-old endpoints in `app/routers/api.py` (`/api/portfolios/upload`,
-`/api/portfolio/{name}/summary`) remain live until step 10 of the Phase G
-plan, when they're removed alongside the table drops.
+All routes require authentication (session cookie OR bearer token).
 """
 from __future__ import annotations
 

app/services/csv_import.py

@@ -221,7 +221,4 @@ def parse_t212_csv(content: str | bytes) -> ParsedPie:
     )
 
 
-# persist_pie removed in Phase G — the parsed pie is returned to the
-# browser by /api/portfolio/parse and lives in localStorage. The server
-# now keeps only the anonymous ticker_universe (see
-# app/services/ticker_universe.py).
+