all: delete the code nothing calls

From the audit (#5178). Each was unreachable from every client:

- Checklist add-item and delete-item: REST POST /items and DELETE /items/<id>,
  the Tauri commands, the store, rest and local adapters, the core's
  add_item/delete_item, set_item_text and remove_item, and the FFI exports.
  Adding, rewording and removing an item are body edits in every editor. The
  checked toggle stays, and its rewriter is simpler without the drop branch.
- Manual unfurl: POST /unfurl and its adapters. Previews arrive in the
  background after a save (unfurl_queue).
- The /api/config `android_client` key, android_release() and the
  APK_NAME/MANIFEST_NAME aliases. Phones poll /api/client/android.
- users.email_verified and users.avatar_path (migration 0037). Nothing set
  the first or read the second; the SMTP reset never checked verification.
- derive::extract_tags (only tests used it; the shared fixture now runs
  through extract_tag_spans), the unused check and link icons, and the
  unused editor_add_item string.
- The blob scheme is renamed tsblob -> inkblob. URLs are built as notes are
  read, so nothing stored carries the old one.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/public-hosting.md

@@ -135,8 +135,10 @@ address can be sent.
 
 Know these before you decide who gets an account.
 
-- **No email verification.** `email_verified` exists on the user row and nothing sets
-  it. Email is used only for password resets (above).
+- **No email verification.** An account's address is whatever was typed when it
+  registered, and email is used only for password resets (above), which go to that
+  address. Nothing changes an address afterwards, so someone who registered with a mistyped
+  one can't reset by email; an admin can issue them a reset link instead.
 - **An admin who forgets their own password**, with email off and no other admin,
   still needs a hand on the database.
 - **No second factor.** A password is the whole of it.