feat(hygiene): add repo-hygiene subagent for dead code + docs audit

[mariuspruvot]

Summary

Adds a manual-invocation subagent that audits the repo for dead Python/TS code, orphan files, and stale doc references (CLAUDE.md, docs/*.md, README). Dry-run by default; opens a cleanup PR only when invoked with apply.

Design + rationale: see the approved plan and the docs/backlog.md entry "Repo hygiene agent".

What's in

• .claude/agents/repo-hygiene.md — subagent definition with Phase 0-3 workflow (Python vulture, TS knip, orphan files, docs audit) + apply mode.
• .repo-hygiene.yml — single config source: allowlist of convention-loaded paths, vulture/knip flags, docs-audit patterns.
• apps/api/pyproject.toml — pin vulture>=2.14,<3 (dev).
• apps/web/package.json — pin knip ^5.30.0 (dev).
• .gitignore — unignore .claude/agents/ so the subagent is tracked; keep .claude/reports/ and .claude/settings.local.json ignored.
• Makefile — hygiene target (discoverability only; agent is invoked via Claude Code, not make).

Non-negotiables

• Dry-run by default. No hook. Manual invocation only.
• Does not touch docs/backlog.md (the brief).
• Any cleanup PR targets main.
• make lint + make typecheck must be green before an apply-mode commit.

Smoke-run on this branch

Both tools execute cleanly.

vulture flagged one item — filtered by the allowlist:

• src/helprs/modules/identity/router.py:67: unused variable 'setup_action' → FastAPI query param, file matches apps/api/src/helprs/modules/*/router.py allowlist. False positive correctly suppressed.

knip real findings (out of scope for this PR, queued as the first apply-mode target):

• Unused files: src/features/dashboard/StatusBadge.tsx, src/features/session/ThinkingBlock.tsx, src/features/session/ToolUseBlock.tsx
• Unused exports: Topbar (shared/components), ContainerSessionError (containerApi), InstallationListResponse type (dashboardApi)
• Unused devDep: @testing-library/jest-dom
• Unlisted deps in shiki.ts: @shikijs/themes, @shikijs/langs

The CLAUDE.md "Conversation UI" paragraph references ToolUseBlock / ThinkingBlock — so the docs audit will flag those refs as affected-by-this-run once the files are deleted in a follow-up.

Test plan

• make lint green
• make typecheck green
• uv sync and npm install succeed with the new pins
• vulture and knip invokable with the commands baked into the agent workflow
• Invoke the agent in a fresh Claude Code session ("audit dead code in the repo") and confirm it produces the structured report
• Invoke with apply against the knip findings to exercise the worktree -> commit -> PR path end-to-end
• Run /claude-md-management:revise-claude-md to add the one-line hygiene entry to CLAUDE.md

🤖 Generated with Claude Code

[helprs-prod]

helPRs session created for this PR.

Skill: challenge-me | Open session

[mariuspruvot]

Pivoting away from the agent — doing the cleanup directly instead.