chore(review): J2 — remove dead code left by the route extractions

[AVADSA25]

Summary

Pure-hygiene companion to #168. The dead-code review found three zombie blocks in codec_dashboard.py — code whose live versions moved into route modules during the extraction series, but whose original copies were never deleted. No behavior change.

codec_dashboard.py: 1,201 → 1,104 LOC (−97).

Removed

Block	Lines	Why dead
_mask_sensitive, _SENSITIVE_FIELDS, _VALIDATION_RULES, _validate_config_updates	445–504	Live copies in routes/config.py (F1). The dashboard copies had zero callers — no @app route, no import, no test ref.
_latest_response_for_session	515–556	Exact duplicate of the live copy in routes/tts.py (F3, called by /api/response there).
shadowed import asyncio	628	asyncio already imported at module level (line 6); the local re-import inside _process_command was dead.

Back-compat handled

• _latest_response_for_session is now re-exported from routes.tts so codec_dashboard._latest_response_for_session still resolves for the 15 behavioral tests in test_pwa_response_bridge.py (verified identity-equal).
• test_response_uses_correlation_helper retargeted to scan routes/tts.py — it was only still green against codec_dashboard.py because of the duplicate this PR removes.

Test plan

• python3.13 -m pytest --ignore=tests/test_skills.py -q → 2,055 passed, 77 skipped
• codec_dashboard._latest_response_for_session is routes.tts._latest_response_for_session ✓
• All 127 routes still registered (incl. /api/config, /api/response, /api/command, /api/chat)
• The 4 config symbols are gone from the codec_dashboard namespace
• git diff confirms only the 3 dead blocks deleted (+9 / −104)
• ruff check: 0 issues

Branches off main (post-#167); independent of #168 (different regions of codec_dashboard.py) — clean merge in either order.

🤖 Generated with Claude Code