Broker — Post-Simplification Dead-Code Cleanup

Context

PR #159 (feat/broker-open-knowledge-system) replaced the broker's per-user-token model with:

• Reads dispatched unauthenticated (mark_fetch / mark_list / mark_versions use empty token).
• One long-lived write token per world, stored in a broker-namespace Secret, shared across all writers.
• Writer authorization at the broker via gateWrite (WorldConfig.Allow against SSO claims) before any dispatch.

That left a lot of code unreachable from any live path. This plan lands AFTER #159 has been observed working in production (knowledge.demarkus.io) — we deliberately keep the dead code around through the initial rollout as a safety net.

Inventory (verified 2026-05-27 against feat/broker-open-knowledge-system HEAD)

Definitely dead (no live callers)

Still alive in slimmed form

• Issuer.authorizedWorlds(claims) — called by /me/install (install.go) and the bare-code /auth/callback branch (server.go) to enumerate writable worlds.
• Issuer.lookupWorld(name) — called by gateWrite in mcp_tools_write.go. (Note: worldWriteTokenStore has its own private copy; could consolidate.)
• Issuer.k8s field — handed to RefreshStore and worldWriteTokenStore in NewServer.

The type name Issuer no longer fits — it doesn't issue anything. After the strip it's a thin "world registry + shared k8s handle." Rename is optional (see Open Questions).

Sweeper

sweeper.go currently runs two responsibilities in one leader-elected loop:

1. Per-issuance reconciliation (drift-pruning issuances Secret against world tokens.toml). Dead — issuances Secret is no longer written.
2. Refresh-token sweep (RefreshStore). Still alive — broker's own bearer refresh tokens still expire and need cleanup.

After (1) is gone, the leader-election plumbing is overkill for (2) — refresh-token sweep can run on every pod with duplicate work being merely wasteful, not incorrect. But keeping leader election isn't wrong either; it's just disproportionate.

Slices

Each slice compiles and go test ./... passes independently.

Slice 1 — Delete sessionCache

• Remove mcp_session.go and mcp_session_test.go entirely.
• Drop mcpGateway.sessionCache field and the newSessionCache(...) call in mcp_gateway.go's constructor.
• Update mcp_gateway.go comments that reference the removed cache.