refactor(platforms): retire deviantart end-to-end (#3069)

Executes the 2026-07-05 product decision (FC downloaders = art-dedicated
services only), which removed Twitter/X and Bluesky but left deviantart
fully wired for seven weeks — the half-retired state rule 22 exists to
prevent.

Removed: the PlatformInfo module and its registry entry, the gallery-dl
extractor block, extension_service's artist-page pattern, the extension's
PLATFORMS + PLATFORM_ARTIST_PATTERNS entries, its manifest host permission
and content-script match, the frontend icon/colour/label, and the operator-
facing "supported platforms" list that still advertised it.

Two judgment calls, both recorded in migration 0088:

  * existing `source` rows are DISABLED, not deleted. The row is the only
    record of the artist's DeviantArt URL. Disabling is also required for
    correctness rather than tidiness: with the platform unregistered the
    download path falls through to gallery-dl, which carries its OWN
    deviantart extractor, so an enabled row would have kept downloading
    from a dropped platform.
  * the `credential` row IS deleted — a live session cookie for a site FC
    will never call again.

Adds the invariant whose absence is why manifest.json drifted in the first
place: nothing tied its domain lists back to the platform table. The
extension suite now asserts both directions, plus that no host permission
belongs to an unclaimed domain (`*://*/*` exempted — FC is self-hosted at
an operator-chosen URL the extension cannot enumerate).

Extension version 1.0.10 -> 1.0.11: ci.yml's guard hard-fails a packaged
extension change without a bump. No release is cut — build.yml's
sign-extension job only runs on main.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/test_platforms_registry.py

@@ -11,10 +11,10 @@ from backend.app.services.platforms import (
 )
 
 
-def test_known_platform_keys_is_gs_six():
+def test_known_platform_keys_is_gs_five():
     assert known_platform_keys() == frozenset({
         "patreon", "subscribestar", "hentaifoundry",
-        "discord", "pixiv", "deviantart",
+        "discord", "pixiv",
     })
 
 
@@ -23,6 +23,15 @@ def test_fanbox_not_in_registry():
     assert "fanbox" not in PLATFORMS
 
 
+def test_deviantart_is_retired():
+    # #3069 executed the 2026-07-05 drop decision (FC downloaders = ART-
+    # DEDICATED services only). The registry is what /api/platforms, the
+    # source validator and the credential validator all read, so its absence
+    # here is what actually retires the platform everywhere else.
+    assert "deviantart" not in PLATFORMS
+    assert auth_type_for("deviantart") is None
+
+
 def test_auth_type_for_known_and_unknown():
     assert auth_type_for("patreon") == "cookies"
     assert auth_type_for("discord") == "token"